coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: implement RMASTER-WP-0023 private-by-default exposure

Browse source 
Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.
This commit is contained in:
codex 2026-08-15 20:08:37 +02:00
parent 6301798fab
commit 4a664533d3
24 changed files with 998 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

10
schemas/README.md
View file

@ -98,6 +98,16 @@ JSON Schema cannot express these; `tools/validate-family-declarations.py` does:
- a rapp `ownership_repo` must not be the rapp repo itself
- declared member repos, named rails, and named reefs must resolve on disk
- a deployable name may belong to at most one rapp
- `exposure.posture: public` on a rapp requires `exposure.grant`,
`binding_admission: production-approved`, and a bound reef that has
granted a public surface (ADR-0008)
- `exposure.posture: public` on a rail requires `exposure.grant` and
`readiness_state: production-approved`
- `exposure.posture: public` on a reef requires `exposure.grants`; a
provider-delegated reef (no rail) cannot be public
- grant port `6443` is never legal
- omitted `exposure` means `private`; the field is additive and must
not be confused with rapp `data_classification: public`
## Rail schema (T04)