Establish Railiance Fabric graph model

fabric/bindings/artifact-store-runtime-secrets-openbao.yaml

@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: artifact-store.object-storage.runtime-secrets-to-openbao
+  name: artifact-store runtime secrets binding
+  owner: artifact-store
+  repo: artifact-store
+  domain: railiance
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  dependency_id: artifact-store.object-storage.needs-runtime-secrets
+  provider_capability_id: railiance-platform.openbao.runtime-secrets
+  provider_interface_id: railiance-platform.openbao.kv-v2
+  status: compatible
+  rationale: Planned object-storage credential vending should use OpenBao for protected runtime secrets.

fabric/bindings/flex-auth-iam-profile-key-cape.yaml

@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: flex-auth.api.iam-profile-to-key-cape
+  name: flex-auth IAM Profile binding
+  owner: flex-auth
+  repo: flex-auth
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: flex-auth.api.needs-iam-profile
+  provider_capability_id: key-cape.iam-profile.issuer
+  provider_interface_id: key-cape.iam-profile.oidc-discovery
+  status: compatible
+  rationale: key-cape is the lightweight IAM Profile implementation for Railiance workloads.

fabric/bindings/flex-auth-runtime-secrets-openbao.yaml

@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: flex-auth.api.runtime-secrets-to-openbao
+  name: flex-auth runtime secrets binding
+  owner: flex-auth
+  repo: flex-auth
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: flex-auth.api.needs-runtime-secrets
+  provider_capability_id: railiance-platform.openbao.runtime-secrets
+  provider_interface_id: railiance-platform.openbao.kv-v2
+  status: exact
+  rationale: flex-auth uses OpenBao KV v2 as the runtime secrets provider.

fabric/bindings/flex-auth-topaz-runtime.yaml

@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: flex-auth.api.topaz-runtime-binding
+  name: flex-auth Topaz runtime binding
+  owner: flex-auth
+  repo: flex-auth
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: flex-auth.api.needs-topaz-runtime
+  provider_capability_id: flex-auth.topaz.authorization-runtime
+  provider_interface_id: flex-auth.topaz.http-api
+  status: exact
+  rationale: flex-auth delegates PDP execution to its Topaz runtime.

fabric/bindings/state-hub-postgresql-cnpg.yaml

@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: the-custodian.state-hub.postgresql-to-cnpg
+  name: State Hub PostgreSQL binding
+  owner: the-custodian
+  repo: the-custodian
+  domain: custodian
+spec:
+  lifecycle: active
+  environments: [all]
+  dependency_id: the-custodian.state-hub.needs-postgresql
+  provider_capability_id: railiance-platform.cnpg.postgresql
+  provider_interface_id: railiance-platform.cnpg.database-connection
+  status: compatible
+  rationale: State Hub persists coordination data in PostgreSQL, with CNPG as the Railiance database provider.