services_hardening_host.v1.json (7315B)
1 { 2 "schema": "radroots.services-hardening.host-decisions.v1", 3 "contract_version": 1, 4 "decision_state": "reserved_preimplementation", 5 "local_admin": { 6 "transport": "http_1_1_over_unix_domain_socket", 7 "base_path": "/v1", 8 "tcp_admin": false, 9 "cors": false, 10 "browser_authentication": false, 11 "mutation_request_envelope": { 12 "required_fields": ["contract_version", "operation_id", "request"], 13 "optional_fields": ["correlation_id"], 14 "contract_version": 1, 15 "operation_id_semantics": "caller_stable_idempotency_identity", 16 "correlation_id_semantics": "caller_safe_trace_identity_or_daemon_generated_when_absent", 17 "identical_operation_id_reuse": "return_original_committed_result", 18 "different_request_operation_id_reuse": { 19 "admin_error_code": "operation_id_conflict", 20 "cli_exit": 5 21 } 22 }, 23 "success_response_envelope": { 24 "required_fields": ["contract_version", "ok", "correlation_id", "result"], 25 "contract_version": 1, 26 "ok": true 27 }, 28 "failure_response_envelope": { 29 "required_fields": ["contract_version", "ok", "correlation_id", "error"], 30 "error_required_fields": ["code", "message"], 31 "contract_version": 1, 32 "ok": false 33 }, 34 "output_safety": { 35 "request_body_max_utf8_bytes": 65536, 36 "response_body_max_utf8_bytes": 1048576, 37 "operation_id_max_utf8_bytes": 128, 38 "correlation_id_max_utf8_bytes": 128, 39 "error_code_max_utf8_bytes": 64, 40 "error_message_max_utf8_bytes": 256, 41 "redaction_required": true, 42 "forbidden_material": ["secret_or_credential_material", "private_identity_material", "decrypted_payload", "raw_absolute_or_resolved_path", "raw_sql_or_database_error", "raw_provider_error", "raw_relay_or_network_error", "source_error_chain"] 43 }, 44 "common_route_suffixes": [ 45 { "method": "GET", "path": "/status", "operation_suffix": "status.get", "request_model": "empty", "response_model": "service_status_v1" }, 46 { "method": "GET", "path": "/config/effective", "operation_suffix": "config.effective.get", "request_model": "empty", "response_model": "effective_config_v1" }, 47 { "method": "GET", "path": "/identity/status", "operation_suffix": "identity.status.get", "request_model": "identity_status_query_v1", "response_model": "identity_status_v1" }, 48 { "method": "POST", "path": "/identity/rekey", "operation_suffix": "identity.rekey", "request_model": "identity_rekey_request_v1", "response_model": "identity_mutation_receipt_v1" }, 49 { "method": "POST", "path": "/identity/replace", "operation_suffix": "identity.replace", "request_model": "identity_replace_request_v1", "response_model": "identity_mutation_receipt_v1" }, 50 { "method": "GET", "path": "/state/status", "operation_suffix": "state.status.get", "request_model": "empty", "response_model": "state_status_v1" }, 51 { "method": "POST", "path": "/state/backup", "operation_suffix": "state.backup.create", "request_model": "state_backup_request_v1", "response_model": "state_backup_receipt_v1" }, 52 { "method": "GET", "path": "/metrics/snapshot", "operation_suffix": "metrics.snapshot.get", "request_model": "empty", "response_model": "metrics_snapshot_v1" } 53 ], 54 "unknown_major_version": "unsupported_contract_version", 55 "unknown_route": "route_not_found", 56 "duplicate_json_fields_rejected": true, 57 "unknown_json_fields_rejected": true 58 }, 59 "peer_authorization": { 60 "linux_service_host": { 61 "credential_api": "SO_PEERCRED", 62 "required": true, 63 "allow": ["peer_uid_equals_daemon_euid", "peer_primary_gid_equals_configured_admin_gid"], 64 "credential_unavailable": "deny", 65 "parent_mode_without_admin_gid": "0700", 66 "socket_mode_without_admin_gid": "0600", 67 "parent_mode_with_admin_gid": "0750", 68 "socket_mode_with_admin_gid": "0660" 69 }, 70 "macos_interactive": { 71 "credential_api": "none_v1", 72 "required": false, 73 "authority": "filesystem_owner_permissions_only", 74 "parent_mode": "0700", 75 "socket_mode": "0600", 76 "peer_credential_equivalence_claim": false 77 }, 78 "other_platforms": { "admin_support": "unsupported_v1" } 79 }, 80 "tcp_operations": { 81 "routes": [ 82 { "method": "GET", "path": "/livez", "source": "cached_supervisor_state" }, 83 { "method": "GET", "path": "/readyz", "source": "cached_readiness_state" }, 84 { "method": "GET", "path": "/metrics", "source": "cached_bounded_metrics_snapshot" } 85 ], 86 "active_probe_per_request": false, 87 "additional_routes": false 88 }, 89 "doctor": { 90 "schema": "radroots.service.doctor.v1", 91 "contract_version": 1, 92 "required_fields": ["contract_version", "service", "instance", "status", "checks"], 93 "check_required_fields": ["id", "status", "required", "deadline_ms", "summary", "remediation_code"], 94 "statuses": ["pass", "fail", "timeout", "skipped"], 95 "required_skipped": "forbidden", 96 "aggregate_statuses": ["pass", "degraded", "fail"], 97 "aggregation": { 98 "required_fail_or_timeout": "fail", 99 "optional_fail_timeout_or_skipped": "degraded", 100 "otherwise": "pass" 101 }, 102 "optional_nonpass_exit": 0, 103 "summary_max_utf8_bytes": 256, 104 "raw_error_or_path_allowed": false, 105 "required_fail_or_timeout_exit": 6 106 }, 107 "exit_codes": [ 108 { "code": 0, "name": "success", "meaning": "successful command or completed graceful first-signal shutdown" }, 109 { "code": 1, "name": "unexpected_internal", "meaning": "unexpected invariant, critical task, or internal failure" }, 110 { "code": 2, "name": "input_or_configuration", "meaning": "CLI, config, validation, or unsupported contract input" }, 111 { "code": 3, "name": "service_or_dependency_unavailable", "meaning": "daemon, required provider, relay, source, or local dependency unavailable" }, 112 { "code": 4, "name": "state_or_identity_unavailable", "meaning": "state, schema, lock, credential, or identity unavailable" }, 113 { "code": 5, "name": "operation_rejected_or_conflict", "meaning": "authorization rejection, idempotency conflict, stale generation, or domain conflict" }, 114 { "code": 6, "name": "doctor_required_check_failed", "meaning": "one or more required doctor checks failed or timed out" } 115 ], 116 "forced_signal_exit": "operating_system_128_plus_signal_not_remapped", 117 "systemd": { 118 "sd_notify_v1": false, 119 "service_type": "simple", 120 "readiness_authority": "cached_http_readyz", 121 "process_running_does_not_imply_ready": true 122 }, 123 "bare_rust_linux": { 124 "qualification_base": "debian_bookworm_slim_digest_pinned_per_receipt", 125 "architectures": ["x86_64", "aarch64"], 126 "rust_install": "rustup_profile_minimal_exact_repository_toolchain", 127 "apt_packages": ["build-essential", "ca-certificates", "git"], 128 "not_required_by_final_graph": ["clang", "libclang-dev", "libsodium-dev", "libsqlite3-dev", "libssl-dev", "pkg-config"], 129 "sqlite": "bundled", 130 "tls": "rustls", 131 "proof": [ 132 "fresh_digest_pinned_base_for_each_architecture", 133 "install_only_declared_apt_packages_and_exact_rust_toolchain", 134 "locked_format_check_test_clippy_rustdoc_release_build", 135 "repeat_with_network_disabled_from_governed_vendor_bundle", 136 "fail_if_undeclared_native_package_is_installed_or_linked" 137 ] 138 } 139 }