feat: define accountability root manifest

examples/discovery/accountability-root-manifest.yaml

@@ -0,0 +1,104 @@
+apiVersion: railiance.fabric/v1alpha2
+kind: AccountabilityRootManifest
+metadata:
+  id: example.accountability-roots
+  name: Example Accountability Roots
+  description: Minimal example showing how a tenant subfabric can be added without changing the parent fabric criterion.
+netkingdom:
+  id: example.netkingdom
+  name: Example Netkingdom
+  king_actor_id: actor.example.king
+actors:
+  - id: actor.example.king
+    role: king
+    name: Example King
+    authority:
+      recovery_authority: true
+      secrets_authority: true
+      backup_authority: true
+      termination_authority: true
+  - id: actor.example.lord
+    role: lord
+    name: Example Lord
+  - id: actor.example.tenant
+    role: tenant
+    name: Example Tenant
+fabrics:
+  - id: fabric.example.primary
+    kind: Fabric
+    name: Example Primary Fabric
+    netkingdom_id: example.netkingdom
+    lord_actor_id: actor.example.lord
+    parent_fabric_id: null
+    status: active
+    boundary:
+      boundary_type: fabric
+      criterion: financial_and_operational_accountability
+      payment_responsibility: actor.example.lord
+      operational_responsibility: actor.example.king
+      recovery_responsibility: actor.example.king
+  - id: subfabric.example.tenant
+    kind: Subfabric
+    name: Example Tenant Subfabric
+    netkingdom_id: example.netkingdom
+    tenant_actor_id: actor.example.tenant
+    parent_fabric_id: fabric.example.primary
+    status: planned
+    boundary:
+      boundary_type: subfabric
+      criterion: restricted_paid_tenant_utility
+      payment_responsibility: actor.example.tenant
+      operational_responsibility: actor.example.lord
+      recovery_responsibility: actor.example.king
+discovery_roots:
+  - id: root.example.state-hub
+    type: state_hub_repo_inventory
+    status: active
+    fabric_id: fabric.example.primary
+    owner_actor_id: actor.example.king
+    source:
+      base_url: http://127.0.0.1:8000
+      api_paths:
+        - /managed-repos/
+      safe_discovery: metadata_only
+    evidence_scope:
+      - repo_inventory
+      - repository_identity
+    refresh:
+      cadence: on_change
+      triggers:
+        - state_hub_repo_inventory_change
+        - operator_request
+  - id: root.example.tenant-api-contracts
+    type: endpoint_contract
+    status: planned
+    fabric_id: fabric.example.primary
+    subfabric_id: subfabric.example.tenant
+    owner_actor_id: actor.example.tenant
+    source:
+      repo_slug: example-tenant
+      path: contracts/openapi
+      safe_discovery: local_files
+    evidence_scope:
+      - endpoint_contract
+      - tenant_boundary
+    refresh:
+      cadence: on_change
+      triggers:
+        - endpoint_contract_change
+        - operator_request
+refresh:
+  cadence: manual
+  triggers:
+    - operator_request
+    - state_hub_repo_inventory_change
+    - endpoint_contract_change
+    - lord_or_tenant_change
+templates:
+  future_subfabric:
+    parent_fabric_id: fabric.example.primary
+    tenant_actor_role: tenant
+    required_updates:
+      - Add tenant actor.
+      - Add Subfabric with tenant_actor_id.
+      - Add subfabric-scoped discovery roots.