feat(handoffs): publish owner task interfaces
Assistant: codex Assistant-Model: gpt-5.6-sol Assistant-Session: 01a023c0-a0a3-7c03-b395-5a0d2757214d
This commit is contained in:
parent
a3952113d5
commit
890f3b05b5
12 changed files with 754 additions and 38 deletions
49
interfaces/ops-warden-workload-reference-v1.yaml
Normal file
49
interfaces/ops-warden-workload-reference-v1.yaml
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
apiVersion: helixforge.repo-manager/v1
|
||||
kind: OwnerTaskInterface
|
||||
metadata:
|
||||
id: helixforge.workloads.ops-warden-reference.v1
|
||||
title: Add explicit workload references to ops-warden lanes
|
||||
source:
|
||||
repo: repo-manager
|
||||
workplan_task: RMGR-WP-0010-T06
|
||||
target:
|
||||
repo: ops-warden
|
||||
owner_agent: ops-warden
|
||||
suggested_work_record: WARDEN-WP-0032
|
||||
approval:
|
||||
dispositions: [approved, amended, rejected]
|
||||
record_in: WARDEN-WP-0032 task or an ops-warden owner decision
|
||||
task:
|
||||
title: Adopt explicit workload references in the lane catalog
|
||||
priority: high
|
||||
objective: >-
|
||||
Let workload-applicable lanes point to authoritative rapp workload identity
|
||||
while keeping the catalog a pointer layer.
|
||||
inputs:
|
||||
- ref: repo-manager/docs/workload-reference-contract_v1.md
|
||||
authority: repo-manager
|
||||
- ref: ops-warden/registry/routing/catalog.yaml
|
||||
authority: ops-warden
|
||||
deliverables:
|
||||
- >-
|
||||
Add workload_ref with required rapp_id and name and optional deployable to
|
||||
every workload-applicable lane.
|
||||
- >-
|
||||
Add an explicit applicability representation that distinguishes
|
||||
not-applicable from an unresolved or invalid workload reference.
|
||||
- Validate every supplied reference through Repo Manager exact resolution.
|
||||
- Preserve native typed identity for lanes that do not represent workloads.
|
||||
constraints:
|
||||
- Do not copy workload classification, criticality, readiness, or placement into the catalog.
|
||||
- Do not infer workload identity from path_template, owner_repo, or repository names.
|
||||
- An absent pointer must not ambiguously mean both unknown and not-applicable.
|
||||
acceptance:
|
||||
- Every workload-applicable lane resolves exactly or reports unknown with a reason.
|
||||
- Every non-workload lane is explicitly not-applicable.
|
||||
- Catalog validation fails on malformed, ambiguous, or undeclared references.
|
||||
- Existing lane identity and routing authority remain owned by ops-warden.
|
||||
verification:
|
||||
- make test
|
||||
- make lint
|
||||
- >-
|
||||
uv run --project /home/worsch/repo-manager rmgr workload index --root /home/worsch
|
||||
50
interfaces/rapp-workload-coverage-v1.yaml
Normal file
50
interfaces/rapp-workload-coverage-v1.yaml
Normal file
|
|
@ -0,0 +1,50 @@
|
|||
apiVersion: helixforge.repo-manager/v1
|
||||
kind: OwnerTaskInterface
|
||||
metadata:
|
||||
id: helixforge.workloads.rapp-coverage.v1
|
||||
title: Clarify universal rapp coverage for managed deployables
|
||||
source:
|
||||
repo: repo-manager
|
||||
workplan_task: RMGR-WP-0010-T05
|
||||
target:
|
||||
repo: railiance-master
|
||||
owner_agent: railiance-master
|
||||
suggested_work_record: owner-selected Railiance Master schema workplan task
|
||||
approval:
|
||||
dispositions: [approved, amended, rejected]
|
||||
record_in: Railiance Master file-backed workplan task or decision
|
||||
task:
|
||||
title: Clarify universal rapp coverage for managed deployables
|
||||
priority: high
|
||||
objective: >-
|
||||
Make the normative rapp contract explicit that every managed running
|
||||
deployable, including operational and tooling workloads participating in
|
||||
controls, belongs to exactly one rapp.
|
||||
inputs:
|
||||
- ref: railiance-master/docs/adr/ADR-0007-rapp-declaration-contract.md
|
||||
authority: railiance-master
|
||||
- ref: repo-manager/docs/adr-004-authoritative-workload-declarations.md
|
||||
authority: repo-manager boundary ruling
|
||||
deliverables:
|
||||
- >-
|
||||
Amend or clarify ADR-0007 and the rapp authoring guide with universal
|
||||
managed-deployable coverage.
|
||||
- >-
|
||||
State that a pre-rapp running deployable is migration debt and remains
|
||||
unknown to workload controls until declared.
|
||||
- >-
|
||||
Preserve native identity for human access, credential patterns, broker
|
||||
actions, one-shot operations, and infrastructure resources that are not workloads.
|
||||
- Keep Railiance Master as the sole owner of the normative rapp schema vocabulary.
|
||||
constraints:
|
||||
- Do not create a parallel generic workload declaration surface.
|
||||
- Do not require one rapp per process when deployables share rollout and rollback fate.
|
||||
- Do not turn non-workload operational subjects into fake workloads.
|
||||
acceptance:
|
||||
- Normative documentation answers whether operational and tooling deployables require rapps.
|
||||
- The exactly-one-rapp invariant remains explicit and schema-compatible.
|
||||
- Migration debt and not-applicable subjects are distinguishable.
|
||||
- Existing valid rapp declarations continue to validate.
|
||||
verification:
|
||||
- tools/validate-family-declarations.py --repo /home/worsch/rapp-issue-core
|
||||
- tools/validate-family-declarations.py --repo /home/worsch/rapp-qonto
|
||||
47
interfaces/workload-projection-transport-v1.yaml
Normal file
47
interfaces/workload-projection-transport-v1.yaml
Normal file
|
|
@ -0,0 +1,47 @@
|
|||
apiVersion: helixforge.repo-manager/v1
|
||||
kind: OwnerTaskInterface
|
||||
metadata:
|
||||
id: helixforge.workloads.projection-transport.v1
|
||||
title: Transport the authoritative workload projection
|
||||
source:
|
||||
repo: repo-manager
|
||||
workplan_task: RMGR-WP-0010-T04
|
||||
target:
|
||||
repo: hub-core
|
||||
owner_agent: hub-core
|
||||
suggested_work_record: owner-selected hub-core projection workplan task
|
||||
approval:
|
||||
dispositions: [approved, amended, rejected]
|
||||
record_in: hub-core file-backed workplan task or decision
|
||||
task:
|
||||
title: Transport the Repo Manager workload projection
|
||||
priority: medium
|
||||
objective: >-
|
||||
Add a hub-core projection port for Repo Manager workload records without
|
||||
transferring semantic authority or exposing Repo Manager persistence.
|
||||
inputs:
|
||||
- ref: repo-manager/docs/workload-reference-contract_v1.md
|
||||
authority: repo-manager
|
||||
- ref: repo-manager/src/repo_manager/workloads.py
|
||||
authority: repo-manager
|
||||
deliverables:
|
||||
- >-
|
||||
Ingest normalized workload records keyed by rapp_id and
|
||||
workload_identity.name, with optional deployable membership.
|
||||
- >-
|
||||
Retain source repository, declaration path, source Git revision, and a
|
||||
canonical UTC observation timestamp.
|
||||
- Expose read-only cross-repository query through the existing projection port.
|
||||
- Make the projection rebuildable from authoritative declarations.
|
||||
constraints:
|
||||
- hub-core transports and queries the projection but does not own workload semantics.
|
||||
- Do not expose or depend on Repo Manager private persistence models.
|
||||
- Do not infer workload identity from repository names or paths.
|
||||
acceptance:
|
||||
- A nine-declaration Repo Manager fixture can be ingested and queried by exact reference.
|
||||
- Deleting and rebuilding the projection from source yields equivalent records.
|
||||
- Unknown references remain unknown and are not repaired by aliases or path parsing.
|
||||
- All observation timestamps are canonical UTC.
|
||||
verification:
|
||||
- make test
|
||||
- make conformance
|
||||
49
interfaces/zone-engine-workload-resolution-v1.yaml
Normal file
49
interfaces/zone-engine-workload-resolution-v1.yaml
Normal file
|
|
@ -0,0 +1,49 @@
|
|||
apiVersion: helixforge.repo-manager/v1
|
||||
kind: OwnerTaskInterface
|
||||
metadata:
|
||||
id: helixforge.workloads.zone-engine-resolution.v1
|
||||
title: Consume explicit workload references without inference
|
||||
source:
|
||||
repo: repo-manager
|
||||
workplan_task: RMGR-WP-0010-T07
|
||||
target:
|
||||
repo: zone-engine
|
||||
owner_agent: zone-engine
|
||||
suggested_work_record: ZONE-WP-0001-T07
|
||||
approval:
|
||||
dispositions: [approved, amended, rejected]
|
||||
record_in: ZONE-WP-0001-T07 or a Zone Engine owner decision
|
||||
task:
|
||||
title: Prove Zone Engine workload resolution without inference
|
||||
priority: high
|
||||
objective: >-
|
||||
Join ops-warden lane pointers to authoritative Repo Manager workload
|
||||
projections and expose unresolved workload identity without guessing.
|
||||
inputs:
|
||||
- ref: repo-manager/docs/workload-reference-contract_v1.md
|
||||
authority: repo-manager
|
||||
- ref: helixforge.workloads.ops-warden-reference.v1
|
||||
authority: ops-warden after approval
|
||||
- ref: zone-engine/docs/security-zones_v0.1.md
|
||||
authority: zone-engine draft pending canon adoption
|
||||
deliverables:
|
||||
- Consume exact rapp_id and workload name pairs plus optional deployable.
|
||||
- Preserve resolved, unknown, and owner-asserted not-applicable as distinct states.
|
||||
- Join authoritative projection data to explicit catalog references only.
|
||||
- Emit evidence that name and path drift cannot change zone membership.
|
||||
constraints:
|
||||
- Do not parse repository slugs, owner_repo, credential paths, or path templates as identity.
|
||||
- Unknown must fail closed wherever zone policy requires workload identity.
|
||||
- Zone Engine does not author workload identity or ops-warden lane pointers.
|
||||
acceptance:
|
||||
- A valid exact reference resolves to one authoritative workload projection.
|
||||
- A mismatched qonto versus rapp-qonto name remains unknown.
|
||||
- A non-workload lane remains not-applicable rather than becoming unknown.
|
||||
- No fallback identity path exists in implementation or fixtures.
|
||||
verification:
|
||||
- >-
|
||||
uv run --project /home/worsch/repo-manager rmgr workload resolve --root
|
||||
/home/worsch --rapp-id rapp-issue-core --name issue-core --deployable issue-core
|
||||
- >-
|
||||
uv run --project /home/worsch/repo-manager rmgr workload resolve --root
|
||||
/home/worsch --rapp-id rapp-qonto --name rapp-qonto
|
||||
Loading…
Add table
Add a link
Reference in a new issue