tegwick
989d5d4f5d
Standard, schema and validator for the founder's admission of one bounded executor run: exact plan by digest, window by risk class, SI MODE @ SCOPE ceiling with least-privilege coverage, blast radius by consumer, named source-pinned checks, revert per mutating step, budget, single use, and the NK-WP-0040 receipt. check-approval verifies a carrier record (Approval Engine or founder SSH signature): aal2 human approver, not the executor, consumed at most once in the window. Examples express the bind split; step 10 is refused as human-intrinsic. 22 tests; make targets; tool index. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Assistant: claude-code Assistant-Model: opus Assistant-Process: 994874@bnt-lap001 Assistant-Session: 6017c416-d619-47eb-bd1a-f670a02d7d87
582 lines
14 KiB
JSON
582 lines
14 KiB
JSON
{
|
|
"$schema": "https://json-schema.org/draft/2020-12/schema",
|
|
"$id": "https://netkingdom.io/schemas/bounded-execution-admission_v0.1.schema.json",
|
|
"title": "NetKingdom Bounded Execution Admission v0.1",
|
|
"description": "An immutable request that a person admits, by digest, for one bounded executor run. Structure only; the semantic rules (BEA-1..BEA-14) are in tools/bounded-execution-admission/validate.py and the standard.",
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"apiVersion",
|
|
"kind",
|
|
"spec"
|
|
],
|
|
"properties": {
|
|
"apiVersion": {
|
|
"const": "netkingdom.io/bounded-execution-admission/v0.1"
|
|
},
|
|
"kind": {
|
|
"const": "BoundedExecutionAdmission"
|
|
},
|
|
"spec": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"id",
|
|
"title",
|
|
"purpose",
|
|
"risk_class",
|
|
"window",
|
|
"approval",
|
|
"executor",
|
|
"scope_ceiling",
|
|
"blast_radius",
|
|
"trust_requires",
|
|
"plan",
|
|
"plan_digest",
|
|
"checks",
|
|
"stop_and_revert",
|
|
"budget",
|
|
"consumption",
|
|
"receipt",
|
|
"not_authorized"
|
|
],
|
|
"properties": {
|
|
"id": {
|
|
"type": "string",
|
|
"pattern": "^BEA-[0-9]{4}-[0-9]{4}$"
|
|
},
|
|
"title": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"purpose": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"work_ref": {
|
|
"type": "string"
|
|
},
|
|
"risk_class": {
|
|
"enum": [
|
|
"low",
|
|
"medium",
|
|
"high"
|
|
]
|
|
},
|
|
"window": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"not_before",
|
|
"not_after"
|
|
],
|
|
"properties": {
|
|
"not_before": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
},
|
|
"not_after": {
|
|
"type": "string",
|
|
"format": "date-time"
|
|
}
|
|
}
|
|
},
|
|
"approval": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"approvers",
|
|
"principal_type",
|
|
"assurance",
|
|
"carriers"
|
|
],
|
|
"properties": {
|
|
"approvers": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"uniqueItems": true
|
|
},
|
|
"principal_type": {
|
|
"const": "HUMAN"
|
|
},
|
|
"assurance": {
|
|
"const": "aal2"
|
|
},
|
|
"carriers": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"enum": [
|
|
"approval-engine",
|
|
"founder-ssh-signature"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"executor": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"identity",
|
|
"principal_type",
|
|
"runtime"
|
|
],
|
|
"properties": {
|
|
"identity": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"principal_type": {
|
|
"enum": [
|
|
"WORKLOAD",
|
|
"AGENT",
|
|
"SERVICE",
|
|
"HUMAN"
|
|
]
|
|
},
|
|
"runtime": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"harness_launched": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"scope_ceiling": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/grant"
|
|
}
|
|
},
|
|
"blast_radius": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"unit",
|
|
"consumers",
|
|
"max_concurrent"
|
|
],
|
|
"properties": {
|
|
"unit": {
|
|
"enum": [
|
|
"consumer",
|
|
"account",
|
|
"host",
|
|
"tenant"
|
|
]
|
|
},
|
|
"consumers": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
},
|
|
"max_concurrent": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
}
|
|
}
|
|
},
|
|
"trust_requires": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"description": "Playbook Capability Contract trust states the executor must find satisfied before the first step.",
|
|
"items": {
|
|
"enum": [
|
|
"bare_host_trust",
|
|
"cluster_trust",
|
|
"bootstrap_secret_trust",
|
|
"bootstrap_identity_trust",
|
|
"runtime_secret_trust",
|
|
"runtime_identity_trust",
|
|
"runtime_authorization_trust",
|
|
"tenant_onboarding_trust"
|
|
]
|
|
}
|
|
},
|
|
"plan": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"source",
|
|
"steps"
|
|
],
|
|
"properties": {
|
|
"source": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"repo",
|
|
"commit",
|
|
"files"
|
|
],
|
|
"properties": {
|
|
"repo": {
|
|
"type": "string"
|
|
},
|
|
"commit": {
|
|
"type": "string",
|
|
"pattern": "^[0-9a-f]{7,40}$"
|
|
},
|
|
"files": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/pinned_file"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"steps": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/step"
|
|
}
|
|
},
|
|
"revert_steps": {
|
|
"type": "array",
|
|
"items": {
|
|
"$ref": "#/$defs/step"
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"plan_digest": {
|
|
"type": "string",
|
|
"pattern": "^sha256:[0-9a-f]{64}$"
|
|
},
|
|
"checks": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"$ref": "#/$defs/check"
|
|
}
|
|
},
|
|
"stop_and_revert": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"on_check_failure",
|
|
"on_budget_exhausted",
|
|
"on_unknown",
|
|
"on_revert_failure"
|
|
],
|
|
"properties": {
|
|
"on_check_failure": {
|
|
"enum": [
|
|
"revert",
|
|
"stop"
|
|
]
|
|
},
|
|
"on_budget_exhausted": {
|
|
"enum": [
|
|
"revert",
|
|
"stop"
|
|
]
|
|
},
|
|
"on_unknown": {
|
|
"const": "stop"
|
|
},
|
|
"on_revert_failure": {
|
|
"const": "stop-and-alert"
|
|
},
|
|
"alert": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"budget": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"wall_time_seconds",
|
|
"attempts",
|
|
"cost"
|
|
],
|
|
"properties": {
|
|
"wall_time_seconds": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"attempts": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"cost": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"compute_cpu_seconds",
|
|
"egress_bytes",
|
|
"currency",
|
|
"amount"
|
|
],
|
|
"properties": {
|
|
"compute_cpu_seconds": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"egress_bytes": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"currency": {
|
|
"type": "string",
|
|
"pattern": "^[A-Z]{3}$"
|
|
},
|
|
"amount": {
|
|
"type": "number",
|
|
"minimum": 0
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"consumption": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"single_use",
|
|
"consume_before_first_step"
|
|
],
|
|
"properties": {
|
|
"single_use": {
|
|
"const": true
|
|
},
|
|
"consume_before_first_step": {
|
|
"const": true
|
|
}
|
|
}
|
|
},
|
|
"receipt": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"schema",
|
|
"emit_to",
|
|
"retain"
|
|
],
|
|
"properties": {
|
|
"schema": {
|
|
"const": "netkingdom.playbook-capability-contract/v0.2#execution-attribution-receipt"
|
|
},
|
|
"emit_to": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"retain": {
|
|
"const": "by-hash-no-secret-values"
|
|
},
|
|
"independent_verifier": {
|
|
"type": "string"
|
|
}
|
|
}
|
|
},
|
|
"not_authorized": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"items": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
}
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"$defs": {
|
|
"grant": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"mode",
|
|
"scope",
|
|
"environments"
|
|
],
|
|
"properties": {
|
|
"mode": {
|
|
"enum": [
|
|
"USE",
|
|
"OBSERVE",
|
|
"OPERATE",
|
|
"ADMINISTER",
|
|
"GOVERN",
|
|
"CONSTRUCT",
|
|
"SOVEREIGN"
|
|
]
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"pattern": "^[a-z0-9][a-z0-9._-]*(/[A-Za-z0-9][A-Za-z0-9._-]*)*$"
|
|
},
|
|
"environments": {
|
|
"type": "array",
|
|
"minItems": 1,
|
|
"uniqueItems": true,
|
|
"items": {
|
|
"enum": [
|
|
"DEVELOPMENT",
|
|
"TEST",
|
|
"STAGING",
|
|
"PRODUCTION",
|
|
"RECOVERY"
|
|
]
|
|
}
|
|
}
|
|
}
|
|
},
|
|
"pinned_file": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"path",
|
|
"sha256"
|
|
],
|
|
"properties": {
|
|
"path": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"sha256": {
|
|
"type": "string",
|
|
"pattern": "^[0-9a-f]{64}$"
|
|
}
|
|
}
|
|
},
|
|
"step": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"id",
|
|
"operation",
|
|
"target",
|
|
"consumer",
|
|
"class",
|
|
"mutates",
|
|
"requires"
|
|
],
|
|
"properties": {
|
|
"id": {
|
|
"type": "string",
|
|
"pattern": "^[a-z][a-z0-9-]*$"
|
|
},
|
|
"operation": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"target": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"consumer": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"class": {
|
|
"enum": [
|
|
"delegable",
|
|
"root-class",
|
|
"human-intrinsic"
|
|
]
|
|
},
|
|
"mutates": {
|
|
"type": "boolean"
|
|
},
|
|
"requires": {
|
|
"$ref": "#/$defs/grant_need"
|
|
},
|
|
"checks_after": {
|
|
"type": "array",
|
|
"items": {
|
|
"type": "string"
|
|
},
|
|
"uniqueItems": true
|
|
},
|
|
"revert": {
|
|
"type": "string"
|
|
},
|
|
"irreversible": {
|
|
"type": "boolean"
|
|
}
|
|
}
|
|
},
|
|
"grant_need": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"mode",
|
|
"scope"
|
|
],
|
|
"properties": {
|
|
"mode": {
|
|
"enum": [
|
|
"USE",
|
|
"OBSERVE",
|
|
"OPERATE",
|
|
"ADMINISTER",
|
|
"GOVERN",
|
|
"CONSTRUCT",
|
|
"SOVEREIGN"
|
|
]
|
|
},
|
|
"scope": {
|
|
"type": "string",
|
|
"pattern": "^[a-z0-9][a-z0-9._-]*(/[A-Za-z0-9][A-Za-z0-9._-]*)*$"
|
|
}
|
|
}
|
|
},
|
|
"check": {
|
|
"type": "object",
|
|
"additionalProperties": false,
|
|
"required": [
|
|
"id",
|
|
"description",
|
|
"ref",
|
|
"sha256",
|
|
"timeout_seconds",
|
|
"expect"
|
|
],
|
|
"properties": {
|
|
"id": {
|
|
"type": "string",
|
|
"pattern": "^[a-z][a-z0-9-]*$"
|
|
},
|
|
"description": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"ref": {
|
|
"type": "string",
|
|
"minLength": 1
|
|
},
|
|
"sha256": {
|
|
"type": "string",
|
|
"pattern": "^[0-9a-f]{64}$"
|
|
},
|
|
"timeout_seconds": {
|
|
"type": "integer",
|
|
"minimum": 1
|
|
},
|
|
"settle_seconds": {
|
|
"type": "integer",
|
|
"minimum": 0
|
|
},
|
|
"expect": {
|
|
"const": "pass"
|
|
}
|
|
}
|
|
}
|
|
}
|
|
}
|