Add versioned ephemeral custody lifecycle

Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a02669-87ee-7a31-b111-edc95a16e0fa
2026-08-22 21:56:42 +02:00 · 2026-08-22 21:56:42 +02:00 · 30e6edc236
commit 30e6edc236
parent 985cef2572
17 changed files with 2855 additions and 6 deletions
--- a/schemas/custody-projection-contract.schema.json
+++ b/schemas/custody-projection-contract.schema.json
@ -0,0 +1,100 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://coulomb.social/schemas/railiance/custody-projection-contract.v1.json",
+  "title": "Railiance ephemeral custody projection contract v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "interface", "version", "workplan_id", "engagement_id", "status",
+    "engagement_contract_sha256", "target", "runner", "window", "authority",
+    "identities"
+  ],
+  "properties": {
+    "interface": {"const": "railiance.custody-projection-contract"},
+    "version": {"const": 1},
+    "workplan_id": {"const": "RAILIANCE-WP-0025"},
+    "engagement_id": {"type": "string", "pattern": "^[A-Z0-9][A-Z0-9._-]{7,127}$"},
+    "status": {"const": "approved"},
+    "engagement_contract_sha256": {"$ref": "#/$defs/sha256"},
+    "target": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "id", "namespace", "deployment", "container", "sender_external_secret", "revision",
+        "image_digest", "contract_sha256"
+      ],
+      "properties": {
+        "id": {"type": "string", "minLength": 1},
+        "namespace": {"$ref": "#/$defs/dnsLabel"},
+        "deployment": {"$ref": "#/$defs/dnsLabel"},
+        "container": {"$ref": "#/$defs/dnsLabel"},
+        "sender_external_secret": {"$ref": "#/$defs/dnsLabel"},
+        "revision": {"type": "string", "pattern": "^[0-9a-f]{40}$"},
+        "image_digest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
+        "contract_sha256": {"$ref": "#/$defs/sha256"}
+      }
+    },
+    "runner": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["namespace", "service_account", "secret_name", "mount_root", "manifest_sha256"],
+      "properties": {
+        "namespace": {"$ref": "#/$defs/dnsLabel"},
+        "service_account": {"$ref": "#/$defs/dnsLabel"},
+        "secret_name": {"$ref": "#/$defs/dnsLabel"},
+        "mount_root": {"type": "string", "pattern": "^/"},
+        "manifest_sha256": {"$ref": "#/$defs/sha256"}
+      }
+    },
+    "window": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["starts_at", "projection_cutoff", "expires_at"],
+      "properties": {
+        "starts_at": {"type": "string", "format": "date-time"},
+        "projection_cutoff": {"type": "string", "format": "date-time"},
+        "expires_at": {"type": "string", "format": "date-time"}
+      }
+    },
+    "authority": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "remote", "registry_path", "registry_field", "kv_mount", "kv_prefix",
+        "eso_service_account", "eso_namespace"
+      ],
+      "properties": {
+        "remote": {"type": "string", "pattern": "^\\S+$"},
+        "registry_path": {"type": "string", "minLength": 1},
+        "registry_field": {"type": "string", "minLength": 1},
+        "kv_mount": {"type": "string", "pattern": "^[^/]+$"},
+        "kv_prefix": {"type": "string", "minLength": 1},
+        "eso_service_account": {"$ref": "#/$defs/dnsLabel"},
+        "eso_namespace": {"$ref": "#/$defs/dnsLabel"}
+      }
+    },
+    "identities": {
+      "type": "array",
+      "minItems": 2,
+      "maxItems": 2,
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["handle", "role", "sender_name", "tenant", "mount_path", "may_read", "may_write"],
+        "properties": {
+          "handle": {"enum": ["token-a", "token-b"]},
+          "role": {"enum": ["attacker", "owner"]},
+          "sender_name": {"type": "string", "minLength": 1},
+          "tenant": {"type": "string", "minLength": 1},
+          "mount_path": {"type": "string", "pattern": "^/"},
+          "may_read": {"const": true},
+          "may_write": {"const": true}
+        }
+      }
+    }
+  },
+  "$defs": {
+    "sha256": {"type": "string", "pattern": "^(sha256:)?[0-9a-f]{64}$"},
+    "dnsLabel": {"type": "string", "pattern": "^[a-z0-9](?:[-a-z0-9]{0,61}[a-z0-9])?$"}
+  }
+}