coulomb/railiance-master
4
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

feat: implement RMASTER-WP-0023 private-by-default exposure

Browse source 
Add the exposure contract, additive family schema fields, validator
checks and fixtures, the reef-railiance exception snapshot, and
routed intakes. Enforcement stays in the owning repos.
This commit is contained in:
codex 2026-08-15 20:08:37 +02:00
parent 6301798fab
commit 4a664533d3
24 changed files with 998 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

64
schemas/rapp.schema.json
View file

@ -108,6 +108,24 @@
"minItems": 1,
"items": { "$ref": "#/$defs/sourceDocument" },
"description": "Documents this declaration was derived from. All three live rapps already carry this consistently."
},
"exposure": {
"type": "object",
"additionalProperties": false,
"required": ["posture"],
"description": "Who may reach this rapp's listener. Optional; omitted means private (ADR-0008). Distinct from data_classification.",
"properties": {
"posture": {
"enum": ["private", "operator", "public"],
"description": "Intended consumer-facing listener. Default if exposure is omitted: private."
},
"grant": { "$ref": "#/$defs/exposureGrant" },
"tunnel": { "$ref": "#/$defs/exposureTunnel" },
"binding_admission": {
"enum": ["declared", "installed", "verified", "production-approved", "deprecated"],
"description": "ADR-0006 admission state of the reef binding this public listener sits on. Not rapp readiness_state. Required by the validator when posture is public."
}
}
}
},
"allOf": [
@ -119,6 +137,23 @@
"description": "consumers requires consumer_contract.",
"if": { "required": ["consumers"] },
"then": { "required": ["consumer_contract"] }
},
{
"description": "public rapp exposure requires a grant object.",
"if": {
"required": ["exposure"],
"properties": {
"exposure": {
"required": ["posture"],
"properties": { "posture": { "const": "public" } }
}
}
},
"then": {
"properties": {
"exposure": { "required": ["grant"] }
}
}
}
],
"$defs": {
@ -356,6 +391,35 @@
"repo": { "$ref": "#/$defs/repoSlug" },
"path": { "type": "string", "minLength": 1 }
}
},
"exposureGrant": {
"type": "object",
"additionalProperties": false,
"required": ["reason", "approved_on", "residual_risk_owner"],
"description": "Accepted residual risk for a public listener. Must name a hostname or a port. Port 6443 is rejected by the validator.",
"properties": {
"hostname": { "type": "string", "minLength": 1 },
"port": { "type": "integer", "minimum": 1, "maximum": 65535 },
"reason": { "type": "string", "minLength": 1 },
"approved_on": { "type": "string", "pattern": "^[0-9]{4}-[0-9]{2}-[0-9]{2}$" },
"residual_risk_owner": { "type": "string", "minLength": 1 }
},
"anyOf": [
{ "required": ["hostname"] },
{ "required": ["port"] }
]
},
"exposureTunnel": {
"type": "object",
"additionalProperties": false,
"required": ["name"],
"description": "Named ops-bridge / SSH tunnel. Does not change packet posture.",
"properties": {
"name": { "type": "string", "minLength": 1 },
"local_port": { "type": "integer", "minimum": 1, "maximum": 65535 }
}
}
}
}