104 lines
3.0 KiB
JSON
104 lines
3.0 KiB
JSON
{
|
|
"schema_version": 4,
|
|
"automatic": [
|
|
"build",
|
|
"test",
|
|
"artifact",
|
|
"canary",
|
|
"evidence"
|
|
],
|
|
"owner": [
|
|
"signed_release_plan"
|
|
],
|
|
"forbidden": [
|
|
"force_push",
|
|
"tag_rewrite",
|
|
"direct_main_push",
|
|
"baseline_mutation",
|
|
"registry_mutation"
|
|
],
|
|
"runtime_deployment": {
|
|
"approval_action": "signed_release_plan",
|
|
"required_capability": "runtime_switch",
|
|
"tag_operations_allowed": false,
|
|
"baseline_mutation_allowed": false,
|
|
"registry_mutation_allowed": false,
|
|
"writer_default": false,
|
|
"rollback_required": true
|
|
},
|
|
"tag_release": {
|
|
"approval_action": "signed_release_plan",
|
|
"required_capability": "tag_publish",
|
|
"separate_controller": true,
|
|
"duplicate_conflict": "fail_closed",
|
|
"rewrite_allowed": false,
|
|
"force_push_allowed": false
|
|
},
|
|
"baseline_registry_finalize": {
|
|
"approval_action": "signed_release_plan",
|
|
"required_capability": "baseline_registry_finalize",
|
|
"separate_controller": true,
|
|
"remote_tag_verification_required": true,
|
|
"gitea_api_verification_required": true,
|
|
"registry_baseline_consistency_required": true
|
|
},
|
|
"approval": {
|
|
"algorithm": "Ed25519",
|
|
"trust_domain": "aios.production",
|
|
"maximum_lifetime_seconds": 3600,
|
|
"release_plan_sha256_required": true,
|
|
"not_before_required": true,
|
|
"replay_protection": true,
|
|
"revocation_fail_closed": true,
|
|
"key_rotation_supported": true,
|
|
"capabilities": [
|
|
"runtime_switch",
|
|
"tag_publish",
|
|
"baseline_registry_finalize"
|
|
]
|
|
},
|
|
"execution": {
|
|
"environment_variable": "AIOS_SILENT_RELEASE_EXECUTION_ENABLED",
|
|
"default_enabled": false,
|
|
"shadow_side_effects_allowed": false,
|
|
"durable_saga_required": true,
|
|
"pre_switch_revalidation_required": true,
|
|
"trusted_candidate_builder_required": true,
|
|
"actual_plan_regeneration_required": true,
|
|
"startup_fail_closed_on_missing_component": true,
|
|
"recovery_worker_shadow_default": true,
|
|
"production_approval_backend_required": true,
|
|
"production_builder_signer": "kms-hsm-secret-manager-only",
|
|
"production_execution_without_backend": "unavailable"
|
|
},
|
|
"durability": {
|
|
"journal": "sha256-hash-chain",
|
|
"probe_journal": "sha256-hash-chain",
|
|
"exclusive_capability_claims": true,
|
|
"side_effect_probe_before_lease_takeover": true,
|
|
"side_effect_probe_before_failed_recoverable_retry": true,
|
|
"probe_results": [
|
|
"NOT_APPLIED",
|
|
"APPLIED_VERIFIED",
|
|
"INDETERMINATE",
|
|
"CONFLICT"
|
|
],
|
|
"probe_operation_digest_required": true,
|
|
"probe_freshness_required": true,
|
|
"tamper_result": "MANUAL_OWNER_REVIEW_REQUIRED"
|
|
},
|
|
"tag_pending": {
|
|
"required_observations": [
|
|
"remote_git_ref",
|
|
"annotated_tag_object",
|
|
"peeled_target",
|
|
"gitea_api",
|
|
"gitea_listing",
|
|
"repository_identity"
|
|
],
|
|
"indeterminate_result": "RECONCILIATION_REQUIRED",
|
|
"conflict_result": "MANUAL_OWNER_REVIEW_REQUIRED",
|
|
"automatic_reconciliation": false
|
|
}
|
|
}
|