commit 63a9735dd29b16c2d996cd3a01fac6b60cd626b7
parent 4f35c29f2efd18becab20739af138b7b66d040b8
Author: triesap <tyson@radroots.org>
Date: Mon, 10 Aug 2026 22:18:26 +0000
contracts: reserve RHI operator surface
- Freeze the complete Unix admin route and model inventory.
- Bind service identity, pagination, and mutation semantics.
- Define exact report, publication, and presence operations.
- Lock doctor, exit, lifecycle, and cached TCP behavior.
Diffstat:
3 files changed, 622 insertions(+), 4 deletions(-)
diff --git a/AGENTS.md b/AGENTS.md
@@ -36,10 +36,13 @@
and `config.toml` or `flake.nix` when they are in scope.
- `.radroots-consumer-root` is the standalone source-lock identity and must
remain exactly `rhi`. The reserved pre-implementation evidence authority is
- `contracts/services_hardening/evidence_policy.v1.json`. RHI source and
- configuration must implement its exact source, selector, cursor, completion,
- coverage, digest, and publication-independence semantics; prototype source
- behavior is not permission to reinterpret them.
+ `contracts/services_hardening/evidence_policy.v1.json`, and the reserved
+ pre-implementation operator authority is
+ `contracts/services_hardening/operator_contract.v1.json`. RHI source and
+ configuration must implement their exact source, selector, cursor,
+ completion, coverage, digest, publication-independence, route, wire-model,
+ identity-role, pagination, mutation, doctor, exit, and TCP semantics;
+ prototype source behavior is not permission to reinterpret them.
- Treat checked-in source, tests, configuration, and prototype behavior as
implementation evidence, not permission to preserve behavior that the active
requirement removes.
diff --git a/contracts/services_hardening/operator_contract.v1.json b/contracts/services_hardening/operator_contract.v1.json
@@ -0,0 +1,266 @@
+{
+ "schema": "radroots.rhi.operator-contract.v1",
+ "contract_version": 1,
+ "decision_state": "reserved_preimplementation",
+ "service": "rhi",
+ "shared_host_contract": {
+ "repository": "https://github.com/radrootslabs/lib",
+ "path": "contracts/architecture/decisions/services_hardening_host.v1.json",
+ "schema": "radroots.services-hardening.host-decisions.v1",
+ "contract_version": 1
+ },
+ "admin": {
+ "transport": "http_1_1_over_unix_domain_socket",
+ "base_path": "/v1",
+ "route_inventory_closed": true,
+ "routes": [
+ { "method": "GET", "path": "/v1/status", "operation_id": "radroots.rhi.status.get.v1", "request_model": "empty", "response_model": "service_status_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/config/effective", "operation_id": "radroots.rhi.config.effective.get.v1", "request_model": "empty", "response_model": "effective_config_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/identity/status", "operation_id": "radroots.rhi.identity.status.get.v1", "request_model": "identity_status_query_v1", "response_model": "identity_status_v1", "mutation": false },
+ { "method": "POST", "path": "/v1/identity/rekey", "operation_id": "radroots.rhi.identity.rekey.v1", "request_model": "identity_rekey_request_v1", "response_model": "identity_mutation_receipt_v1", "mutation": true },
+ { "method": "POST", "path": "/v1/identity/replace", "operation_id": "radroots.rhi.identity.replace.v1", "request_model": "identity_replace_request_v1", "response_model": "identity_mutation_receipt_v1", "mutation": true },
+ { "method": "GET", "path": "/v1/identity/public", "operation_id": "radroots.rhi.identity.public.get.v1", "request_model": "identity_public_query_v1", "response_model": "identity_public_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/state/status", "operation_id": "radroots.rhi.state.status.get.v1", "request_model": "empty", "response_model": "state_status_v1", "mutation": false },
+ { "method": "POST", "path": "/v1/state/backup", "operation_id": "radroots.rhi.state.backup.create.v1", "request_model": "state_backup_request_v1", "response_model": "state_backup_receipt_v1", "mutation": true },
+ { "method": "GET", "path": "/v1/metrics/snapshot", "operation_id": "radroots.rhi.metrics.snapshot.get.v1", "request_model": "empty", "response_model": "metrics_snapshot_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/reconciliation/status", "operation_id": "radroots.rhi.reconciliation.status.get.v1", "request_model": "empty", "response_model": "reconciliation_status_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/reconciliation/jobs", "operation_id": "radroots.rhi.reconciliation.jobs.list.v1", "request_model": "reconciliation_jobs_query_v1", "response_model": "reconciliation_jobs_page_v1", "mutation": false },
+ { "method": "POST", "path": "/v1/reconciliation/refresh", "operation_id": "radroots.rhi.reconciliation.refresh.v1", "request_model": "reconciliation_refresh_request_v1", "response_model": "reconciliation_refresh_receipt_v1", "mutation": true },
+ { "method": "GET", "path": "/v1/sources", "operation_id": "radroots.rhi.sources.list.v1", "request_model": "sources_query_v1", "response_model": "sources_page_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/trades/{trade_id}/projection", "operation_id": "radroots.rhi.trade.projection.get.v1", "request_model": "empty", "response_model": "trade_projection_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/trades/{trade_id}/reports/current", "operation_id": "radroots.rhi.trade.report.current.get.v1", "request_model": "empty", "response_model": "report_detail_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/trades/{trade_id}/reports", "operation_id": "radroots.rhi.trade.reports.list.v1", "request_model": "reports_query_v1", "response_model": "reports_page_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/publication/backlog", "operation_id": "radroots.rhi.publication.backlog.list.v1", "request_model": "publication_backlog_query_v1", "response_model": "publication_backlog_page_v1", "mutation": false },
+ { "method": "GET", "path": "/v1/publication/targets", "operation_id": "radroots.rhi.publication.targets.list.v1", "request_model": "publication_targets_query_v1", "response_model": "publication_targets_page_v1", "mutation": false },
+ { "method": "POST", "path": "/v1/publication/retry", "operation_id": "radroots.rhi.publication.retry.v1", "request_model": "publication_retry_request_v1", "response_model": "publication_retry_receipt_v1", "mutation": true },
+ { "method": "GET", "path": "/v1/presence/desired", "operation_id": "radroots.rhi.presence.desired.get.v1", "request_model": "empty", "response_model": "presence_desired_v1", "mutation": false },
+ { "method": "POST", "path": "/v1/presence/render", "operation_id": "radroots.rhi.presence.render.v1", "request_model": "presence_render_request_v1", "response_model": "presence_render_receipt_v1", "mutation": true },
+ { "method": "POST", "path": "/v1/presence/refresh", "operation_id": "radroots.rhi.presence.refresh.v1", "request_model": "presence_refresh_request_v1", "response_model": "presence_refresh_receipt_v1", "mutation": true }
+ ],
+ "model_wire_contract": {
+ "encoding": "utf8_json",
+ "object_unknown_fields": "reject",
+ "duplicate_fields": "reject",
+ "null": "forbidden",
+ "optional_field_representation": "absent",
+ "integer_representation": "exact_json_integer",
+ "utc_time_unit": "signed_integer_unix_seconds",
+ "string_length_unit": "utf8_bytes",
+ "array_order": "preserved_unless_type_declares_canonical_sort",
+ "response_body_max_utf8_bytes": 1048576
+ },
+ "identity_contract": {
+ "roles": [
+ { "id": "service", "required": true, "disabled_allowed": false, "providers": ["encrypted_file"] }
+ ],
+ "rekey_provider": "encrypted_file_only",
+ "replace_provider_variants": {
+ "discriminator": "provider",
+ "encrypted_file": {
+ "required_fields": ["provider", "envelope_path", "credential_reference", "expected_public_key"],
+ "provider_value": "encrypted_file"
+ }
+ }
+ },
+ "types": {
+ "rhi_literal": { "kind": "literal", "value": "rhi" },
+ "rhi_config_schema_literal": { "kind": "literal", "value": "radroots.rhi.config" },
+ "contract_version_literal": { "kind": "literal", "value": 1 },
+ "bool": { "kind": "boolean" },
+ "u64": { "kind": "integer", "minimum": 0, "maximum": 18446744073709551615 },
+ "positive_u32": { "kind": "integer", "minimum": 1, "maximum": 4294967295 },
+ "utc_seconds": { "kind": "integer", "unit": "unix_seconds", "minimum": 0, "maximum": 9223372036854775807 },
+ "bounded_id": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 128, "pattern": "^[A-Za-z0-9][A-Za-z0-9._:-]*$" },
+ "stable_id": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 64, "pattern": "^[a-z][a-z0-9_-]*$" },
+ "operation_id": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 128 },
+ "reason_code": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 64, "pattern": "^[a-z][a-z0-9_]*$" },
+ "reason_codes": { "kind": "array", "items": "reason_code", "maximum_items": 32, "unique": true, "canonical_sort": "ascending_utf8" },
+ "sha256_hex": { "kind": "string", "utf8_bytes": 64, "pattern": "^[0-9a-f]{64}$" },
+ "public_key_hex": { "kind": "string", "utf8_bytes": 64, "pattern": "^[0-9a-f]{64}$" },
+ "trade_id": { "kind": "string", "utf8_bytes": 32, "pattern": "^[0-9a-f]{32}$" },
+ "mutation_id": { "kind": "alias", "target": "sha256_hex" },
+ "event_id": { "kind": "alias", "target": "sha256_hex" },
+ "report_id": { "kind": "alias", "target": "sha256_hex" },
+ "report_contract_literal": { "kind": "literal", "value": "radroots.rhi.evidence_attestation.v1" },
+ "attestation_method_literal": { "kind": "literal", "value": "signed_evidence_snapshot" },
+ "absolute_path": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 4096, "pattern": "^/" },
+ "credential_reference": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 256 },
+ "confirmation": { "kind": "literal", "value": "confirm" },
+ "identity_role": { "kind": "enum", "values": ["service"] },
+ "encrypted_file_provider": { "kind": "literal", "value": "encrypted_file" },
+ "identity_provider_kind": { "kind": "enum", "values": ["encrypted_file"] },
+ "identity_provider_replacement": { "kind": "tagged_union", "discriminator": "provider", "variants": ["encrypted_file_replacement"] },
+ "encrypted_file_replacement": { "kind": "closed_object", "fields": { "provider": "encrypted_file_provider", "envelope_path": "absolute_path", "credential_reference": "credential_reference", "expected_public_key": "public_key_hex" } },
+ "service_phase": { "kind": "enum", "values": ["starting", "ready", "degraded", "unready", "stopping", "failed"] },
+ "uptime_millis": { "kind": "integer", "minimum": 0, "maximum": 18446744073709551615, "unit": "milliseconds_from_injected_monotonic_clock" },
+ "integrity_state": { "kind": "enum", "values": ["verified", "verification_required", "failed"] },
+ "writer_lock_state": { "kind": "enum", "values": ["held_by_daemon", "free", "conflict"] },
+ "configuration_source": { "kind": "enum", "values": ["explicit_config", "derived_repo_local"] },
+ "configuration_identity": { "kind": "closed_object", "fields": { "schema": "rhi_config_schema_literal", "schema_version": "contract_version_literal", "digest": "sha256_hex", "source": "configuration_source" } },
+ "persistence_health": { "kind": "enum", "values": ["ready", "read_only", "repair_required", "unavailable"] },
+ "persistence_state": { "kind": "closed_object", "fields": { "health": "persistence_health", "schema_version": "positive_u32", "generation": "u64", "integrity": "integrity_state", "reason_codes": "reason_codes" } },
+ "provider_health": { "kind": "enum", "values": ["ready", "degraded", "unavailable"] },
+ "identity_health": { "kind": "closed_object", "fields": { "configured": "bool", "available": "bool", "reason_codes": "reason_codes" } },
+ "provider_state": { "kind": "closed_object", "fields": { "health": "provider_health", "service": "identity_health", "reason_codes": "reason_codes" } },
+ "transport_health": { "kind": "enum", "values": ["ready", "degraded", "unavailable"] },
+ "transport_state": { "kind": "closed_object", "fields": { "health": "transport_health", "required_sources_ready": "bool", "required_publication_targets_ready": "bool", "connected_relay_count": "u64", "reason_codes": "reason_codes" } },
+ "coverage": { "kind": "enum", "values": ["Missing", "Partial", "ScopeSatisfied", "Unsupported"] },
+ "outcome": { "kind": "enum", "values": ["Valid", "Invalid", "Indeterminate"] },
+ "job_state": { "kind": "enum", "values": ["pending", "leased", "retry_scheduled", "completed", "failed"] },
+ "source_completion": { "kind": "enum", "values": ["complete", "incomplete_timeout", "incomplete_unavailable", "incomplete_resource_limit", "incomplete_unknown", "unsupported"] },
+ "publication_state": { "kind": "enum", "values": ["disabled", "pending", "submitted", "accepted", "rejected", "rate_limited", "auth_required", "failed", "unknown"] },
+ "presence_state": { "kind": "enum", "values": ["disabled", "dirty", "committed", "pending", "submitted", "accepted", "rejected", "failed", "unknown"] },
+ "page_limit": { "kind": "integer", "minimum": 1, "maximum": 200 },
+ "page_cursor": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 512, "encoding": "canonical_base64url_no_padding", "integrity": "server_authenticated" },
+ "safe_code": { "kind": "string", "minimum_utf8_bytes": 1, "maximum_utf8_bytes": 64, "pattern": "^[a-z][a-z0-9_]*$" },
+ "safe_counts": { "kind": "map", "key": "safe_code", "value": "u64", "maximum_entries": 128, "canonical_sort": "ascending_key_utf8" },
+ "stable_metrics": { "kind": "map", "key": "safe_code", "value": "u64", "maximum_entries": 256, "high_cardinality_values_forbidden": true, "canonical_sort": "ascending_key_utf8" },
+ "config_provenance": { "kind": "map", "key": "safe_code", "value": "config_provenance_value", "maximum_entries": 512, "canonical_sort": "ascending_key_utf8" },
+ "config_provenance_value": { "kind": "enum", "values": ["bootstrap_cli", "toml", "safe_default", "derived_path"] },
+ "redacted_config": { "kind": "canonical_json_object", "schema": "radroots.rhi.config@1", "maximum_utf8_bytes": 786432, "protected_material": "redacted_or_omitted" },
+ "build_info": { "kind": "closed_object", "fields": { "version": "bounded_id", "revision": "git_revision", "toolchain": "bounded_id", "contract_versions": "safe_counts" } },
+ "git_revision": { "kind": "string", "utf8_bytes": 40, "pattern": "^[0-9a-f]{40}$" },
+ "rhi_status": { "kind": "closed_object", "fields": { "policy_digest": "sha256_hex", "dirty_trade_count": "u64", "job_counts": "safe_counts", "coverage_counts": "safe_counts", "outcome_counts": "safe_counts", "publication_counts": "safe_counts", "presence": "presence_state" } },
+ "optional_utc_seconds": { "kind": "optional", "representation": "absent_parent_field", "value": "utc_seconds" },
+ "optional_event_id": { "kind": "optional", "representation": "absent_parent_field", "value": "event_id" },
+ "optional_report_id": { "kind": "optional", "representation": "absent_parent_field", "value": "report_id" },
+ "evidence_cursor": { "kind": "closed_object", "fields": { "created_at_unix_seconds": "utc_seconds", "event_id_lowercase_hex": "event_id" } },
+ "optional_evidence_cursor": { "kind": "optional", "representation": "absent_parent_field", "value": "evidence_cursor" },
+ "job_summaries": { "kind": "array", "items": "job_summary", "maximum_items": 200, "ordered": true },
+ "job_summary": { "kind": "closed_object", "fields": { "job_id": "bounded_id", "trade_id": "trade_id", "state": "job_state", "dirty_generation": "u64", "attempt_count": "u64", "scheduled_at_utc": "utc_seconds", "lease_expires_at_utc": "optional_utc_seconds", "reason_codes": "reason_codes" } },
+ "source_summaries": { "kind": "array", "items": "source_summary", "maximum_items": 200, "ordered": true },
+ "source_summary": { "kind": "closed_object", "fields": { "source_id": "stable_id", "required": "bool", "completion": "source_completion", "cursor": "optional_evidence_cursor", "last_attempt_at_utc": "optional_utc_seconds", "reason_codes": "reason_codes" } },
+ "report_summaries": { "kind": "array", "items": "report_summary", "maximum_items": 200, "ordered": true },
+ "report_summary": { "kind": "closed_object", "fields": { "report_id": "report_id", "trade_id": "trade_id", "claim_mutation_id": "mutation_id", "coverage": "coverage", "outcome": "outcome", "observed_at_utc": "utc_seconds", "attestation_event_id": "event_id", "supersedes_report_id": "optional_report_id" } },
+ "publication_items": { "kind": "array", "items": "publication_item", "maximum_items": 200, "ordered": true },
+ "publication_item": { "kind": "closed_object", "fields": { "workflow_id": "bounded_id", "report_id": "report_id", "event_id": "event_id", "exact_bytes_digest": "sha256_hex", "state": "publication_state", "attempt_count": "u64", "next_attempt_at_utc": "optional_utc_seconds", "reason_codes": "reason_codes" } },
+ "publication_target_items": { "kind": "array", "items": "publication_target_item", "maximum_items": 200, "ordered": true },
+ "publication_target_item": { "kind": "closed_object", "fields": { "workflow_id": "bounded_id", "target_id": "stable_id", "state": "publication_state", "attempt_count": "u64", "last_attempt_at_utc": "optional_utc_seconds", "reason_codes": "reason_codes" } },
+ "document_digests": { "kind": "map", "key": "bounded_id", "value": "sha256_hex", "maximum_entries": 16, "canonical_sort": "ascending_key_utf8" },
+ "target_count": { "kind": "integer", "minimum": 0, "maximum": 64 }
+ },
+ "models": {
+ "empty": { "fields": {} },
+ "service_status_v1": { "fields": { "contract_version": { "type": "contract_version_literal", "presence": "required" }, "service": { "type": "rhi_literal", "presence": "required" }, "instance": { "type": "bounded_id", "presence": "required" }, "phase": { "type": "service_phase", "presence": "required" }, "ready": { "type": "bool", "presence": "required" }, "uptime_millis": { "type": "uptime_millis", "presence": "required" }, "reason_codes": { "type": "reason_codes", "presence": "required" }, "build_info": { "type": "build_info", "presence": "required" }, "configuration": { "type": "configuration_identity", "presence": "required" }, "persistence": { "type": "persistence_state", "presence": "required" }, "provider": { "type": "provider_state", "presence": "required" }, "transport": { "type": "transport_state", "presence": "required" }, "rhi": { "type": "rhi_status", "presence": "required" } } },
+ "effective_config_v1": { "fields": { "schema": { "type": "rhi_config_schema_literal", "presence": "required" }, "schema_version": { "type": "contract_version_literal", "presence": "required" }, "provenance": { "type": "config_provenance", "presence": "required" }, "redacted_config": { "type": "redacted_config", "presence": "required" }, "config_digest": { "type": "sha256_hex", "presence": "required" }, "policy_digest": { "type": "sha256_hex", "presence": "required" } } },
+ "identity_status_query_v1": { "fields": { "role": { "type": "identity_role", "presence": "required" } } },
+ "identity_status_v1": { "fields": { "role": { "type": "identity_role", "presence": "required" }, "provider": { "type": "identity_provider_kind", "presence": "required" }, "configured": { "type": "bool", "presence": "required" }, "available": { "type": "bool", "presence": "required" }, "generation": { "type": "u64", "presence": "required" }, "reason_codes": { "type": "reason_codes", "presence": "required" }, "public_key": { "type": "public_key_hex", "presence": "optional" } } },
+ "identity_rekey_request_v1": { "fields": { "role": { "type": "identity_role", "presence": "required" }, "provider": { "type": "encrypted_file_provider", "presence": "required" }, "expected_generation": { "type": "u64", "presence": "required" }, "new_credential_reference": { "type": "credential_reference", "presence": "required" }, "confirmation": { "type": "confirmation", "presence": "required" } } },
+ "identity_replace_request_v1": { "fields": { "role": { "type": "identity_role", "presence": "required" }, "expected_generation": { "type": "u64", "presence": "required" }, "replacement": { "type": "identity_provider_replacement", "presence": "required" }, "confirmation": { "type": "confirmation", "presence": "required" } } },
+ "identity_mutation_receipt_v1": { "fields": { "operation_id": { "type": "operation_id", "presence": "required" }, "role": { "type": "identity_role", "presence": "required" }, "previous_public_key": { "type": "public_key_hex", "presence": "required" }, "current_public_key": { "type": "public_key_hex", "presence": "required" }, "generation": { "type": "u64", "presence": "required" } } },
+ "identity_public_query_v1": { "fields": { "role": { "type": "identity_role", "presence": "required" } } },
+ "identity_public_v1": { "fields": { "role": { "type": "identity_role", "presence": "required" }, "public_key": { "type": "public_key_hex", "presence": "required" }, "generation": { "type": "u64", "presence": "required" } } },
+ "state_status_v1": { "fields": { "schema_version": { "type": "positive_u32", "presence": "required" }, "generation": { "type": "u64", "presence": "required" }, "integrity": { "type": "integrity_state", "presence": "required" }, "writer_lock": { "type": "writer_lock_state", "presence": "required" }, "backup_eligible": { "type": "bool", "presence": "required" }, "reason_codes": { "type": "reason_codes", "presence": "required" } } },
+ "state_backup_request_v1": { "fields": { "target_path": { "type": "absolute_path", "presence": "required" }, "expected_generation": { "type": "u64", "presence": "required" }, "confirmation": { "type": "confirmation", "presence": "required" } } },
+ "state_backup_receipt_v1": { "fields": { "operation_id": { "type": "operation_id", "presence": "required" }, "manifest_digest": { "type": "sha256_hex", "presence": "required" }, "snapshot_generation": { "type": "u64", "presence": "required" }, "completed_at_utc": { "type": "utc_seconds", "presence": "required" } } },
+ "metrics_snapshot_v1": { "fields": { "captured_at_utc": { "type": "utc_seconds", "presence": "required" }, "metrics": { "type": "stable_metrics", "presence": "required" } } },
+ "reconciliation_status_v1": { "fields": { "dirty_trade_count": { "type": "u64", "presence": "required" }, "job_counts": { "type": "safe_counts", "presence": "required" }, "oldest_pending_at_utc": { "type": "optional_utc_seconds", "presence": "optional" }, "required_source_failures": { "type": "u64", "presence": "required" }, "policy_digest": { "type": "sha256_hex", "presence": "required" } } },
+ "reconciliation_jobs_query_v1": { "fields": { "limit": { "type": "page_limit", "presence": "required" }, "cursor": { "type": "page_cursor", "presence": "optional" }, "state": { "type": "job_state", "presence": "optional" }, "trade_id": { "type": "trade_id", "presence": "optional" } } },
+ "reconciliation_jobs_page_v1": { "fields": { "snapshot_generation": { "type": "u64", "presence": "required" }, "items": { "type": "job_summaries", "presence": "required" }, "next_cursor": { "type": "page_cursor", "presence": "optional" } } },
+ "reconciliation_refresh_request_v1": { "fields": { "trade_id": { "type": "trade_id", "presence": "required" }, "expected_dirty_generation": { "type": "u64", "presence": "required" } } },
+ "reconciliation_refresh_receipt_v1": { "fields": { "operation_id": { "type": "operation_id", "presence": "required" }, "trade_id": { "type": "trade_id", "presence": "required" }, "job_id": { "type": "bounded_id", "presence": "required" }, "dirty_generation": { "type": "u64", "presence": "required" } } },
+ "sources_query_v1": { "fields": { "limit": { "type": "page_limit", "presence": "required" }, "cursor": { "type": "page_cursor", "presence": "optional" }, "required": { "type": "bool", "presence": "optional" }, "completion": { "type": "source_completion", "presence": "optional" } } },
+ "sources_page_v1": { "fields": { "snapshot_generation": { "type": "u64", "presence": "required" }, "items": { "type": "source_summaries", "presence": "required" }, "next_cursor": { "type": "page_cursor", "presence": "optional" } } },
+ "trade_projection_v1": { "fields": { "trade_id": { "type": "trade_id", "presence": "required" }, "dirty_generation": { "type": "u64", "presence": "required" }, "policy_digest": { "type": "sha256_hex", "presence": "required" }, "manifest_digest": { "type": "sha256_hex", "presence": "required" }, "projection_digest": { "type": "sha256_hex", "presence": "required" }, "coverage": { "type": "coverage", "presence": "required" }, "outcome": { "type": "outcome", "presence": "required" }, "reason_codes": { "type": "reason_codes", "presence": "required" }, "observed_at_utc": { "type": "utc_seconds", "presence": "required" } } },
+ "report_detail_v1": { "fields": { "contract_id": { "type": "report_contract_literal", "presence": "required" }, "contract_version": { "type": "contract_version_literal", "presence": "required" }, "report_id": { "type": "report_id", "presence": "required" }, "issuer_pubkey": { "type": "public_key_hex", "presence": "required" }, "trade_id": { "type": "trade_id", "presence": "required" }, "trade_generation": { "type": "u64", "presence": "required" }, "claim_mutation_id": { "type": "mutation_id", "presence": "required" }, "evidence_policy_digest": { "type": "sha256_hex", "presence": "required" }, "evidence_manifest_digest": { "type": "sha256_hex", "presence": "required" }, "reducer_contract_id": { "type": "bounded_id", "presence": "required" }, "reducer_contract_version": { "type": "positive_u32", "presence": "required" }, "projection_digest": { "type": "sha256_hex", "presence": "required" }, "statement_digest": { "type": "sha256_hex", "presence": "required" }, "attestation_method": { "type": "attestation_method_literal", "presence": "required" }, "coverage": { "type": "coverage", "presence": "required" }, "outcome": { "type": "outcome", "presence": "required" }, "reason_codes": { "type": "reason_codes", "presence": "required" }, "observed_at_unix_s": { "type": "utc_seconds", "presence": "required" }, "attestation_event_id": { "type": "event_id", "presence": "required" }, "supersedes_report_id": { "type": "report_id", "presence": "optional" }, "supersedes_event_id": { "type": "event_id", "presence": "optional" } } },
+ "reports_query_v1": { "fields": { "limit": { "type": "page_limit", "presence": "required" }, "cursor": { "type": "page_cursor", "presence": "optional" }, "outcome": { "type": "outcome", "presence": "optional" } } },
+ "reports_page_v1": { "fields": { "snapshot_generation": { "type": "u64", "presence": "required" }, "items": { "type": "report_summaries", "presence": "required" }, "next_cursor": { "type": "page_cursor", "presence": "optional" } } },
+ "publication_backlog_query_v1": { "fields": { "limit": { "type": "page_limit", "presence": "required" }, "cursor": { "type": "page_cursor", "presence": "optional" }, "state": { "type": "publication_state", "presence": "optional" } } },
+ "publication_backlog_page_v1": { "fields": { "snapshot_generation": { "type": "u64", "presence": "required" }, "items": { "type": "publication_items", "presence": "required" }, "next_cursor": { "type": "page_cursor", "presence": "optional" } } },
+ "publication_targets_query_v1": { "fields": { "limit": { "type": "page_limit", "presence": "required" }, "cursor": { "type": "page_cursor", "presence": "optional" }, "workflow_id": { "type": "bounded_id", "presence": "optional" }, "state": { "type": "publication_state", "presence": "optional" } } },
+ "publication_targets_page_v1": { "fields": { "snapshot_generation": { "type": "u64", "presence": "required" }, "items": { "type": "publication_target_items", "presence": "required" }, "next_cursor": { "type": "page_cursor", "presence": "optional" } } },
+ "publication_retry_request_v1": { "fields": { "workflow_id": { "type": "bounded_id", "presence": "required" }, "expected_generation": { "type": "u64", "presence": "required" } } },
+ "publication_retry_receipt_v1": { "fields": { "operation_id": { "type": "operation_id", "presence": "required" }, "workflow_id": { "type": "bounded_id", "presence": "required" }, "generation": { "type": "u64", "presence": "required" }, "exact_bytes_digest": { "type": "sha256_hex", "presence": "required" }, "target_count": { "type": "target_count", "presence": "required" } } },
+ "presence_desired_v1": { "fields": { "generation": { "type": "u64", "presence": "required" }, "state": { "type": "presence_state", "presence": "required" }, "document_digests": { "type": "document_digests", "presence": "required" }, "reason_codes": { "type": "reason_codes", "presence": "required" } } },
+ "presence_render_request_v1": { "fields": { "expected_generation": { "type": "u64", "presence": "required" } } },
+ "presence_render_receipt_v1": { "fields": { "operation_id": { "type": "operation_id", "presence": "required" }, "generation": { "type": "u64", "presence": "required" }, "document_digests": { "type": "document_digests", "presence": "required" } } },
+ "presence_refresh_request_v1": { "fields": { "expected_generation": { "type": "u64", "presence": "required" } } },
+ "presence_refresh_receipt_v1": { "fields": { "operation_id": { "type": "operation_id", "presence": "required" }, "generation": { "type": "u64", "presence": "required" }, "state": { "type": "presence_state", "presence": "required" }, "document_digests": { "type": "document_digests", "presence": "required" }, "target_count": { "type": "target_count", "presence": "required" } } }
+ },
+ "path_parameters": {
+ "trade_id": { "type": "trade_id", "source": "percent_decoded_single_path_segment", "slash_allowed": false }
+ },
+ "report_contract": {
+ "content_contract": "radroots.rhi.evidence_attestation.v1",
+ "report_id_equals_statement_digest": true,
+ "supersession_reference_presence": "supersedes_report_id_and_supersedes_event_id_both_or_neither",
+ "current_selection": ["trade_generation_descending", "observed_at_unix_s_descending", "statement_digest_descending"],
+ "relay_arrival_order_authoritative": false
+ },
+ "pagination": {
+ "cursor_type": "page_cursor",
+ "limit_min": 1,
+ "limit_max": 200,
+ "terminal_page": "next_cursor_field_absent",
+ "cursor_reuse": "same_route_same_filters_only",
+ "filter_or_route_mismatch": "invalid_cursor",
+ "jobs_order": ["scheduled_at_utc_ascending", "job_id_ascending"],
+ "jobs_snapshot": "maximum_job_sequence_fixed_by_first_page_cursor",
+ "sources_order": ["source_id_ascending"],
+ "sources_snapshot": "configuration_generation_fixed_by_first_page_cursor",
+ "reports_order": ["observed_at_utc_descending", "report_id_descending"],
+ "reports_snapshot": "maximum_report_sequence_fixed_by_first_page_cursor",
+ "publication_backlog_order": ["next_attempt_at_utc_ascending_nulls_first", "workflow_id_ascending"],
+ "publication_backlog_snapshot": "maximum_publication_sequence_fixed_by_first_page_cursor",
+ "publication_targets_order": ["workflow_id_ascending", "target_id_ascending"],
+ "publication_targets_snapshot": "maximum_publication_target_sequence_fixed_by_first_page_cursor"
+ },
+ "mutation_contract": {
+ "request_envelope_required_fields": ["contract_version", "operation_id", "request"],
+ "request_envelope_optional_fields": ["correlation_id"],
+ "effective_correlation_id_required_in_response": true,
+ "identical_operation_id_reuse": "return_original_committed_result",
+ "different_request_operation_id_reuse": { "admin_error_code": "operation_id_conflict", "cli_exit": 5 },
+ "success_visibility": "response_only_after_local_authoritative_commit",
+ "relay_submission_or_delivery_required_for_success": false,
+ "committed_effects": {
+ "radroots.rhi.identity.rekey.v1": "identity_generation_credential_binding_and_operation_audit",
+ "radroots.rhi.identity.replace.v1": "identity_generation_public_key_binding_and_operation_audit",
+ "radroots.rhi.state.backup.create.v1": "verified_snapshot_manifest_digest_and_operation_audit",
+ "radroots.rhi.reconciliation.refresh.v1": "generation_fenced_durable_job_schedule_and_operation_audit",
+ "radroots.rhi.publication.retry.v1": "same_committed_exact_bytes_existing_target_set_retry_schedule_and_operation_audit",
+ "radroots.rhi.presence.render.v1": "deterministic_desired_documents_exact_bytes_digests_generation_and_operation_audit",
+ "radroots.rhi.presence.refresh.v1": "same_committed_presence_bytes_immutable_targets_retry_schedule_and_operation_audit"
+ }
+ }
+ },
+ "doctor": {
+ "shared_schema": "radroots.service.doctor.v1",
+ "contract_version": 1,
+ "checks": [
+ { "id": "paths_permissions", "required": true },
+ { "id": "writer_lock", "required": true },
+ { "id": "sqlite_schema", "required": true },
+ { "id": "sqlite_integrity", "required": true },
+ { "id": "sqlite_free_space", "required": true },
+ { "id": "identity_binding", "required": true },
+ { "id": "admin_bind_policy", "required": true },
+ { "id": "operations_bind_policy", "required": true },
+ { "id": "network_policy", "required": true },
+ { "id": "required_sources", "required": true },
+ { "id": "cursor_checkpoint", "required": true },
+ { "id": "reconciliation_leases", "required": true },
+ { "id": "reconciliation_backlog", "required": true },
+ { "id": "publication_invariants", "required": true },
+ { "id": "clock_skew", "required": false }
+ ]
+ },
+ "exit_codes": [
+ { "code": 0, "name": "success", "meaning": "successful command or completed graceful first-signal shutdown" },
+ { "code": 1, "name": "unexpected_internal", "meaning": "unexpected invariant, critical task, or internal failure" },
+ { "code": 2, "name": "input_or_configuration", "meaning": "CLI, config, validation, or unsupported contract input" },
+ { "code": 3, "name": "service_or_dependency_unavailable", "meaning": "daemon, required provider, relay, source, or local dependency unavailable" },
+ { "code": 4, "name": "state_or_identity_unavailable", "meaning": "state, schema, lock, credential, or identity unavailable" },
+ { "code": 5, "name": "operation_rejected_or_conflict", "meaning": "authorization rejection, idempotency conflict, stale generation, or domain conflict" },
+ { "code": 6, "name": "doctor_required_check_failed", "meaning": "one or more required doctor checks failed or timed out" }
+ ],
+ "tcp_operations": {
+ "routes": [
+ { "method": "GET", "path": "/livez", "source": "cached_supervisor_state" },
+ { "method": "GET", "path": "/readyz", "source": "cached_readiness_state" },
+ { "method": "GET", "path": "/metrics", "source": "cached_bounded_metrics_snapshot" }
+ ],
+ "active_probe_per_request": false,
+ "additional_routes": false
+ }
+}
diff --git a/tests/services_hardening_operator_contract.rs b/tests/services_hardening_operator_contract.rs
@@ -0,0 +1,349 @@
+#![forbid(unsafe_code)]
+
+use serde_json::Value;
+use sha2::{Digest, Sha256};
+use std::collections::BTreeSet;
+
+const OPERATOR_CONTRACT: &str =
+ include_str!("../contracts/services_hardening/operator_contract.v1.json");
+const CONSUMER_ROOT: &str = include_str!("../.radroots-consumer-root");
+
+fn contract() -> Value {
+ serde_json::from_str(OPERATOR_CONTRACT).expect("operator contract must be valid JSON")
+}
+
+fn sha256_hex(bytes: &[u8]) -> String {
+ Sha256::digest(bytes)
+ .iter()
+ .map(|byte| format!("{byte:02x}"))
+ .collect()
+}
+
+fn decision_sections_digest(value: &Value) -> String {
+ let sections = serde_json::json!({
+ "identity_contract": value["admin"]["identity_contract"],
+ "model_wire_contract": value["admin"]["model_wire_contract"],
+ "models": value["admin"]["models"],
+ "mutation_contract": value["admin"]["mutation_contract"],
+ "pagination": value["admin"]["pagination"],
+ "path_parameters": value["admin"]["path_parameters"],
+ "report_contract": value["admin"]["report_contract"],
+ "types": value["admin"]["types"]
+ });
+ sha256_hex(&serde_json::to_vec(§ions).expect("serialize decision sections"))
+}
+
+#[test]
+fn source_lock_identity_and_shared_host_reference_are_exact() {
+ assert_eq!(CONSUMER_ROOT, "rhi\n");
+ let value = contract();
+ assert_eq!(value["schema"], "radroots.rhi.operator-contract.v1");
+ assert_eq!(value["contract_version"], 1);
+ assert_eq!(value["decision_state"], "reserved_preimplementation");
+ assert_eq!(value["service"], "rhi");
+ assert_eq!(
+ value["shared_host_contract"],
+ serde_json::json!({
+ "repository": "https://github.com/radrootslabs/lib",
+ "path": "contracts/architecture/decisions/services_hardening_host.v1.json",
+ "schema": "radroots.services-hardening.host-decisions.v1",
+ "contract_version": 1
+ })
+ );
+}
+
+#[test]
+fn admin_inventory_is_closed_unique_and_model_complete() {
+ let value = contract();
+ assert_eq!(
+ value["admin"]["transport"],
+ "http_1_1_over_unix_domain_socket"
+ );
+ assert_eq!(value["admin"]["base_path"], "/v1");
+ assert_eq!(value["admin"]["route_inventory_closed"], true);
+ let routes = value["admin"]["routes"].as_array().expect("routes");
+ let exact_routes = routes
+ .iter()
+ .map(|route| {
+ format!(
+ "{}|{}|{}|{}|{}|{}",
+ route["method"].as_str().unwrap(),
+ route["path"].as_str().unwrap(),
+ route["operation_id"].as_str().unwrap(),
+ route["request_model"].as_str().unwrap(),
+ route["response_model"].as_str().unwrap(),
+ route["mutation"].as_bool().unwrap()
+ )
+ })
+ .collect::<Vec<_>>();
+ assert_eq!(
+ exact_routes,
+ [
+ "GET|/v1/status|radroots.rhi.status.get.v1|empty|service_status_v1|false",
+ "GET|/v1/config/effective|radroots.rhi.config.effective.get.v1|empty|effective_config_v1|false",
+ "GET|/v1/identity/status|radroots.rhi.identity.status.get.v1|identity_status_query_v1|identity_status_v1|false",
+ "POST|/v1/identity/rekey|radroots.rhi.identity.rekey.v1|identity_rekey_request_v1|identity_mutation_receipt_v1|true",
+ "POST|/v1/identity/replace|radroots.rhi.identity.replace.v1|identity_replace_request_v1|identity_mutation_receipt_v1|true",
+ "GET|/v1/identity/public|radroots.rhi.identity.public.get.v1|identity_public_query_v1|identity_public_v1|false",
+ "GET|/v1/state/status|radroots.rhi.state.status.get.v1|empty|state_status_v1|false",
+ "POST|/v1/state/backup|radroots.rhi.state.backup.create.v1|state_backup_request_v1|state_backup_receipt_v1|true",
+ "GET|/v1/metrics/snapshot|radroots.rhi.metrics.snapshot.get.v1|empty|metrics_snapshot_v1|false",
+ "GET|/v1/reconciliation/status|radroots.rhi.reconciliation.status.get.v1|empty|reconciliation_status_v1|false",
+ "GET|/v1/reconciliation/jobs|radroots.rhi.reconciliation.jobs.list.v1|reconciliation_jobs_query_v1|reconciliation_jobs_page_v1|false",
+ "POST|/v1/reconciliation/refresh|radroots.rhi.reconciliation.refresh.v1|reconciliation_refresh_request_v1|reconciliation_refresh_receipt_v1|true",
+ "GET|/v1/sources|radroots.rhi.sources.list.v1|sources_query_v1|sources_page_v1|false",
+ "GET|/v1/trades/{trade_id}/projection|radroots.rhi.trade.projection.get.v1|empty|trade_projection_v1|false",
+ "GET|/v1/trades/{trade_id}/reports/current|radroots.rhi.trade.report.current.get.v1|empty|report_detail_v1|false",
+ "GET|/v1/trades/{trade_id}/reports|radroots.rhi.trade.reports.list.v1|reports_query_v1|reports_page_v1|false",
+ "GET|/v1/publication/backlog|radroots.rhi.publication.backlog.list.v1|publication_backlog_query_v1|publication_backlog_page_v1|false",
+ "GET|/v1/publication/targets|radroots.rhi.publication.targets.list.v1|publication_targets_query_v1|publication_targets_page_v1|false",
+ "POST|/v1/publication/retry|radroots.rhi.publication.retry.v1|publication_retry_request_v1|publication_retry_receipt_v1|true",
+ "GET|/v1/presence/desired|radroots.rhi.presence.desired.get.v1|empty|presence_desired_v1|false",
+ "POST|/v1/presence/render|radroots.rhi.presence.render.v1|presence_render_request_v1|presence_render_receipt_v1|true",
+ "POST|/v1/presence/refresh|radroots.rhi.presence.refresh.v1|presence_refresh_request_v1|presence_refresh_receipt_v1|true"
+ ]
+ );
+ let route_keys = routes
+ .iter()
+ .map(|route| format!("{} {}", route["method"], route["path"]))
+ .collect::<BTreeSet<_>>();
+ let operation_ids = routes
+ .iter()
+ .map(|route| route["operation_id"].as_str().expect("operation ID"))
+ .collect::<BTreeSet<_>>();
+ assert_eq!(route_keys.len(), routes.len());
+ assert_eq!(operation_ids.len(), routes.len());
+ assert!(
+ operation_ids
+ .iter()
+ .all(|id| id.starts_with("radroots.rhi.") && id.ends_with(".v1"))
+ );
+
+ let models = value["admin"]["models"].as_object().expect("models");
+ let types = value["admin"]["types"].as_object().expect("types");
+ for route in routes {
+ for key in ["request_model", "response_model"] {
+ let model = route[key].as_str().expect("model reference");
+ assert!(models.contains_key(model), "missing model {model}");
+ }
+ assert_eq!(route["mutation"], route["method"] == "POST");
+ }
+ for (model_name, model) in models {
+ assert_eq!(
+ model
+ .as_object()
+ .unwrap()
+ .keys()
+ .map(String::as_str)
+ .collect::<Vec<_>>(),
+ ["fields"],
+ "model {model_name} must be a closed field inventory"
+ );
+ for (field_name, field) in model["fields"].as_object().unwrap() {
+ assert_eq!(
+ field
+ .as_object()
+ .unwrap()
+ .keys()
+ .map(String::as_str)
+ .collect::<Vec<_>>(),
+ ["presence", "type"],
+ "field {model_name}.{field_name} must bind only type and presence"
+ );
+ assert!(matches!(
+ field["presence"].as_str(),
+ Some("required" | "optional")
+ ));
+ let type_name = field["type"].as_str().unwrap();
+ assert!(types.contains_key(type_name), "unknown type {type_name}");
+ }
+ }
+ for (type_name, descriptor) in types {
+ let referenced = match descriptor["kind"].as_str().unwrap() {
+ "array" => vec![descriptor["items"].as_str().unwrap()],
+ "map" => vec![
+ descriptor["key"].as_str().unwrap(),
+ descriptor["value"].as_str().unwrap(),
+ ],
+ "closed_object" => descriptor["fields"]
+ .as_object()
+ .unwrap()
+ .values()
+ .map(|field| field.as_str().unwrap())
+ .collect(),
+ "tagged_union" => descriptor["variants"]
+ .as_array()
+ .unwrap()
+ .iter()
+ .map(|variant| variant.as_str().unwrap())
+ .collect(),
+ "alias" => vec![descriptor["target"].as_str().unwrap()],
+ "optional" => vec![descriptor["value"].as_str().unwrap()],
+ "boolean" | "canonical_json_object" | "enum" | "integer" | "literal" | "string" => {
+ Vec::new()
+ }
+ kind => panic!("unknown descriptor kind {kind} for {type_name}"),
+ };
+ for reference in referenced {
+ assert!(
+ types.contains_key(reference),
+ "type {type_name} references missing type {reference}"
+ );
+ }
+ }
+ assert_eq!(
+ value["admin"]["identity_contract"],
+ serde_json::json!({
+ "roles": [{ "id": "service", "required": true, "disabled_allowed": false, "providers": ["encrypted_file"] }],
+ "rekey_provider": "encrypted_file_only",
+ "replace_provider_variants": {
+ "discriminator": "provider",
+ "encrypted_file": {
+ "required_fields": ["provider", "envelope_path", "credential_reference", "expected_public_key"],
+ "provider_value": "encrypted_file"
+ }
+ }
+ })
+ );
+ assert_eq!(
+ value["admin"]["types"]["service_phase"],
+ serde_json::json!({ "kind": "enum", "values": ["starting", "ready", "degraded", "unready", "stopping", "failed"] })
+ );
+ assert_eq!(
+ value["admin"]["types"]["coverage"],
+ serde_json::json!({ "kind": "enum", "values": ["Missing", "Partial", "ScopeSatisfied", "Unsupported"] })
+ );
+ assert_eq!(
+ value["admin"]["types"]["outcome"],
+ serde_json::json!({ "kind": "enum", "values": ["Valid", "Invalid", "Indeterminate"] })
+ );
+ assert_eq!(
+ value["admin"]["models"]["service_status_v1"]["fields"]
+ .as_object()
+ .unwrap()
+ .keys()
+ .map(String::as_str)
+ .collect::<Vec<_>>(),
+ [
+ "build_info",
+ "configuration",
+ "contract_version",
+ "instance",
+ "persistence",
+ "phase",
+ "provider",
+ "ready",
+ "reason_codes",
+ "rhi",
+ "service",
+ "transport",
+ "uptime_millis"
+ ]
+ );
+ assert_eq!(
+ value["admin"]["path_parameters"],
+ serde_json::json!({
+ "trade_id": { "type": "trade_id", "source": "percent_decoded_single_path_segment", "slash_allowed": false }
+ })
+ );
+ assert_eq!(
+ value["admin"]["report_contract"],
+ serde_json::json!({
+ "content_contract": "radroots.rhi.evidence_attestation.v1",
+ "report_id_equals_statement_digest": true,
+ "supersession_reference_presence": "supersedes_report_id_and_supersedes_event_id_both_or_neither",
+ "current_selection": ["trade_generation_descending", "observed_at_unix_s_descending", "statement_digest_descending"],
+ "relay_arrival_order_authoritative": false
+ })
+ );
+ assert_eq!(
+ value["admin"]["pagination"],
+ serde_json::json!({
+ "cursor_type": "page_cursor",
+ "limit_min": 1,
+ "limit_max": 200,
+ "terminal_page": "next_cursor_field_absent",
+ "cursor_reuse": "same_route_same_filters_only",
+ "filter_or_route_mismatch": "invalid_cursor",
+ "jobs_order": ["scheduled_at_utc_ascending", "job_id_ascending"],
+ "jobs_snapshot": "maximum_job_sequence_fixed_by_first_page_cursor",
+ "sources_order": ["source_id_ascending"],
+ "sources_snapshot": "configuration_generation_fixed_by_first_page_cursor",
+ "reports_order": ["observed_at_utc_descending", "report_id_descending"],
+ "reports_snapshot": "maximum_report_sequence_fixed_by_first_page_cursor",
+ "publication_backlog_order": ["next_attempt_at_utc_ascending_nulls_first", "workflow_id_ascending"],
+ "publication_backlog_snapshot": "maximum_publication_sequence_fixed_by_first_page_cursor",
+ "publication_targets_order": ["workflow_id_ascending", "target_id_ascending"],
+ "publication_targets_snapshot": "maximum_publication_target_sequence_fixed_by_first_page_cursor"
+ })
+ );
+ let mutation_operations = routes
+ .iter()
+ .filter(|route| route["mutation"] == true)
+ .map(|route| route["operation_id"].as_str().unwrap())
+ .collect::<BTreeSet<_>>();
+ let committed_effects = value["admin"]["mutation_contract"]["committed_effects"]
+ .as_object()
+ .unwrap()
+ .keys()
+ .map(String::as_str)
+ .collect::<BTreeSet<_>>();
+ assert_eq!(mutation_operations, committed_effects);
+ assert_eq!(
+ decision_sections_digest(&value),
+ "cbb049e8aaa52db31ee99f18556fd6d9121032c06ac20377c5e63496092b539f"
+ );
+}
+
+#[test]
+fn doctor_exit_and_tcp_contracts_are_exact() {
+ let value = contract();
+ assert_eq!(
+ value["doctor"],
+ serde_json::json!({
+ "shared_schema": "radroots.service.doctor.v1",
+ "contract_version": 1,
+ "checks": [
+ { "id": "paths_permissions", "required": true },
+ { "id": "writer_lock", "required": true },
+ { "id": "sqlite_schema", "required": true },
+ { "id": "sqlite_integrity", "required": true },
+ { "id": "sqlite_free_space", "required": true },
+ { "id": "identity_binding", "required": true },
+ { "id": "admin_bind_policy", "required": true },
+ { "id": "operations_bind_policy", "required": true },
+ { "id": "network_policy", "required": true },
+ { "id": "required_sources", "required": true },
+ { "id": "cursor_checkpoint", "required": true },
+ { "id": "reconciliation_leases", "required": true },
+ { "id": "reconciliation_backlog", "required": true },
+ { "id": "publication_invariants", "required": true },
+ { "id": "clock_skew", "required": false }
+ ]
+ })
+ );
+ assert_eq!(
+ value["exit_codes"],
+ serde_json::json!([
+ { "code": 0, "name": "success", "meaning": "successful command or completed graceful first-signal shutdown" },
+ { "code": 1, "name": "unexpected_internal", "meaning": "unexpected invariant, critical task, or internal failure" },
+ { "code": 2, "name": "input_or_configuration", "meaning": "CLI, config, validation, or unsupported contract input" },
+ { "code": 3, "name": "service_or_dependency_unavailable", "meaning": "daemon, required provider, relay, source, or local dependency unavailable" },
+ { "code": 4, "name": "state_or_identity_unavailable", "meaning": "state, schema, lock, credential, or identity unavailable" },
+ { "code": 5, "name": "operation_rejected_or_conflict", "meaning": "authorization rejection, idempotency conflict, stale generation, or domain conflict" },
+ { "code": 6, "name": "doctor_required_check_failed", "meaning": "one or more required doctor checks failed or timed out" }
+ ])
+ );
+ assert_eq!(
+ value["tcp_operations"],
+ serde_json::json!({
+ "routes": [
+ { "method": "GET", "path": "/livez", "source": "cached_supervisor_state" },
+ { "method": "GET", "path": "/readyz", "source": "cached_readiness_state" },
+ { "method": "GET", "path": "/metrics", "source": "cached_bounded_metrics_snapshot" }
+ ],
+ "active_probe_per_request": false,
+ "additional_routes": false
+ })
+ );
+}
