128 lines
3.9 KiB
YAML
128 lines
3.9 KiB
YAML
# Merge this fragment after openapi-authorized-task-writer-fragment.yaml.
|
|
components:
|
|
schemas:
|
|
OwnerAuthorizationTaskWriterRequest:
|
|
type: object
|
|
additionalProperties: false
|
|
required:
|
|
- action
|
|
- task_id
|
|
- repository
|
|
- base_ref
|
|
- base_oid
|
|
- target_branch
|
|
- one_time_use
|
|
- expires_in_seconds
|
|
- production_change_authorized
|
|
- tag_change_authorized
|
|
- baseline_change_authorized
|
|
- main_write_authorized
|
|
- allowed_operations
|
|
- denied_operations
|
|
properties:
|
|
action:
|
|
type: string
|
|
const: AUTHORIZE_TASK_WRITER_PROVISIONING
|
|
task_id:
|
|
type: string
|
|
pattern: '^[A-Z0-9][A-Z0-9._:-]{7,127}$'
|
|
repository:
|
|
type: string
|
|
const: aios/aios
|
|
base_ref:
|
|
type: string
|
|
const: refs/heads/main
|
|
base_oid:
|
|
type: string
|
|
pattern: '^[0-9a-f]{40}$'
|
|
target_branch:
|
|
type: string
|
|
pattern: '^agent/[A-Za-z0-9][A-Za-z0-9._/-]{2,179}$'
|
|
one_time_use:
|
|
type: boolean
|
|
const: true
|
|
expires_in_seconds:
|
|
type: integer
|
|
minimum: 60
|
|
maximum: 900
|
|
production_change_authorized:
|
|
type: boolean
|
|
const: false
|
|
tag_change_authorized:
|
|
type: boolean
|
|
const: false
|
|
baseline_change_authorized:
|
|
type: boolean
|
|
const: false
|
|
main_write_authorized:
|
|
type: boolean
|
|
const: false
|
|
allowed_operations:
|
|
type: array
|
|
minItems: 4
|
|
maxItems: 4
|
|
uniqueItems: true
|
|
items:
|
|
type: string
|
|
enum:
|
|
- create_worktree
|
|
- create_target_branch_if_absent
|
|
- commit_to_target_branch
|
|
- push_target_branch
|
|
denied_operations:
|
|
type: array
|
|
minItems: 11
|
|
maxItems: 11
|
|
uniqueItems: true
|
|
items:
|
|
type: string
|
|
enum:
|
|
- direct_main_push
|
|
- force_push
|
|
- tag_create
|
|
- tag_update
|
|
- tag_delete
|
|
- branch_delete
|
|
- repository_admin
|
|
- baseline_write
|
|
- production_deploy
|
|
- production_marker_write
|
|
- history_rewrite
|
|
|
|
paths:
|
|
/api/governance/owner-authorizations:
|
|
post:
|
|
operationId: authorizeAndProvisionTaskWriter
|
|
summary: Record an audited Owner authorization and provision a scoped writer
|
|
description: >
|
|
Authenticates an existing non-wildcard, allow-listed Owner credential
|
|
through a pre-existing exact scope. It does not mint or modify bearer
|
|
credentials. It records a task-bound authorization event and delegates
|
|
grant signing, validation and one-shot provisioning to the existing
|
|
governed bridge. Main, tag, Baseline and production capabilities are
|
|
always denied.
|
|
x-openai-isConsequential: true
|
|
security:
|
|
- bearerAuth: []
|
|
requestBody:
|
|
required: true
|
|
content:
|
|
application/json:
|
|
schema:
|
|
$ref: '#/components/schemas/OwnerAuthorizationTaskWriterRequest'
|
|
responses:
|
|
'200':
|
|
description: READY_FOR_CODE_AUTHORING and audited authorization receipt
|
|
'400':
|
|
description: Invalid, incomplete or over-broad request
|
|
'401':
|
|
description: Existing Owner credential is missing or invalid
|
|
'403':
|
|
description: Owner, identity, exact scope or credential proof rejected
|
|
'409':
|
|
description: Main drift, branch conflict or provisioning conflict
|
|
'500':
|
|
description: Receipt safety or broker internal failure
|
|
'503':
|
|
description: Broker disabled or governance tool unavailable
|