owner
6ffd7fe19c
Apply the approved Implementation Baseline 1.1 architecture revisions onto the current mainline, verified faithful to the delivered change bundle: - Add aios_baseline: signed owner-delegation-grant.v1 / operational-epoch.v1 / task-principal.v1 auth chain, runtime contract + deployment-truth evaluator, declarative operation registry (effect-class + fail-closed dispatch), lineage ledger, release/recipe/saga ledger, bounded optimization controller, authenticated HTTP transport, resident worker loop and systemd host probe. - Extend existing Job authority (aios_gitops_job_controller/executor) with durable intent/receipt/reconcile and fail-closed admission; harden task_plane/store heartbeat CAS and terminal-state fencing; make reconciliation_controller fail-closed on incomplete/drift evidence. - Add isolated-validation profile templates (deploy/baseline-v1.1, systemd .example), source change/rollback tooling (tools/baseline_v1_1), the AT-01..AT-23 acceptance matrix, M0-M5 runbook, installation/rollback docs and the baseline_v1_1 test suite. - Keep legacy write authorities untouched; isolated-validation profile only. Staged blobs verified byte-identical to the delivered source-changes bundle. Cross-platform baseline tests pass; systemd/fcntl-dependent paths require the declared Linux x86_64 + CPython 3.12 + systemd runtime (site-bound).
116 lines
2.7 KiB
JSON
116 lines
2.7 KiB
JSON
{
|
|
"contracts": [
|
|
{
|
|
"bindings": {},
|
|
"component_id": "sample",
|
|
"contract_revision": 1,
|
|
"contract_schema": "aios.runtime-contract.v1",
|
|
"credential_refs": {},
|
|
"entrypoints": {
|
|
"status": {
|
|
"component_id": "sample",
|
|
"environment": "staging",
|
|
"resolver_ref": "service://sample/status"
|
|
}
|
|
},
|
|
"environment": "staging",
|
|
"lifecycle": "active",
|
|
"operations": [
|
|
"service-status"
|
|
],
|
|
"resource_refs": {},
|
|
"tenant_scope": "validation"
|
|
}
|
|
],
|
|
"host_bindings": {
|
|
"validation:staging:sample": "REPLACE_WITH_EXISTING_SERVICE.service"
|
|
},
|
|
"identities": [
|
|
{
|
|
"role": "owner",
|
|
"subject_id": "owner",
|
|
"tenant_id": "validation",
|
|
"token_file": "${CREDENTIALS_DIRECTORY}/aios-baseline-user-token"
|
|
},
|
|
{
|
|
"role": "worker",
|
|
"subject_id": "machine-worker",
|
|
"tenant_id": "validation",
|
|
"token_file": "${CREDENTIALS_DIRECTORY}/aios-baseline-worker-token",
|
|
"worker_id": "diagnostic-worker"
|
|
}
|
|
],
|
|
"listen": {
|
|
"host": "127.0.0.1",
|
|
"port": 8769
|
|
},
|
|
"machine_key_file": "${CREDENTIALS_DIRECTORY}/aios-baseline-machine-key",
|
|
"machine_key_id": "validation-machine",
|
|
"operations": [
|
|
{
|
|
"effect_class": "READ_ONLY",
|
|
"handler_ref": "host.service_status",
|
|
"input_schema": "aios.operation.service-status.input.v1",
|
|
"operation_id": "service-status",
|
|
"owner_boundary": {
|
|
"mode": "WITHIN_GRANT"
|
|
},
|
|
"readback": {
|
|
"mode": "NONE",
|
|
"required": false
|
|
},
|
|
"reconcile": {
|
|
"mode": "NONE"
|
|
},
|
|
"required_permissions": [
|
|
"service-status"
|
|
],
|
|
"retry": {
|
|
"max_attempts": 2,
|
|
"mode": "SAFE"
|
|
},
|
|
"rollback": {
|
|
"mode": "NONE"
|
|
},
|
|
"timeout_seconds": 10,
|
|
"version": 1
|
|
}
|
|
],
|
|
"owner_key_scopes": {
|
|
"validation-owner": {
|
|
"subject_ids": [
|
|
"owner"
|
|
],
|
|
"tenant_ids": [
|
|
"validation"
|
|
]
|
|
}
|
|
},
|
|
"owner_public_key_files": {
|
|
"validation-owner": "/etc/aios-baseline/owner-public.pem"
|
|
},
|
|
"profile": "isolated-validation",
|
|
"schema": "aios.baseline-server-config.v1",
|
|
"state_dir": "/var/lib/aios-baseline",
|
|
"workers": [
|
|
{
|
|
"capabilities": [
|
|
"service-status"
|
|
],
|
|
"fallback_executor": false,
|
|
"heartbeat_seconds": 15,
|
|
"identity": "machine-worker",
|
|
"max_concurrency": 1,
|
|
"priority": 10,
|
|
"subject_scope": [
|
|
"owner"
|
|
],
|
|
"tenant_scope": [
|
|
"validation"
|
|
],
|
|
"worker_id": "diagnostic-worker"
|
|
}
|
|
],
|
|
"receipt_public_key_files": {}
|
|
}
|