Sync fabric workplan IDs

Declare forge graph contracts
2026-06-05 17:12:48 +02:00 · 2026-06-05 17:10:31 +02:00
39 changed files with 900 additions and 0 deletions
--- a/catalog/capability-types.yaml
+++ b/catalog/capability-types.yaml
@@ -87,6 +87,80 @@ spec:
        - sts-token
      tags: [storage, credentials, security]

+    - id: kubernetes-runtime
+      name: Kubernetes runtime
+      lifecycle: active
+      description: Provides the Kubernetes API, namespaces, workloads, Services, Ingresses, and runtime primitives consumed by Railiance services.
+      default_criticality: critical
+      default_data_classification: restricted
+      expected_interface_types:
+        - kubernetes-api
+        - kubernetes-crd
+      tags: [kubernetes, cluster, runtime]
+
+    - id: ci-cd-template-catalog
+      name: CI/CD template catalog
+      lifecycle: planned
+      description: Provides reusable workflow templates, release gates, and delivery conventions for Railiance workloads.
+      default_criticality: medium
+      default_data_classification: internal
+      expected_interface_types:
+        - workflow-template-contract
+        - cli
+      tags: [ci, cd, gitops, enablement]
+
+    - id: source-hosting
+      name: Source hosting
+      lifecycle: active
+      description: Hosts Git repositories, repository metadata, review surfaces, and source-forge web/API access.
+      default_criticality: high
+      default_data_classification: confidential
+      expected_interface_types:
+        - web-ui
+        - http-api
+        - git-ssh
+      tags: [forge, git, source]
+
+    - id: container-registry
+      name: Container registry
+      lifecycle: active
+      description: Publishes and serves OCI container images for Railiance workloads.
+      default_criticality: high
+      default_data_classification: confidential
+      expected_interface_types:
+        - oci-registry
+      tags: [forge, registry, container-image]
+
+    - id: python-package-registry
+      name: Python package registry
+      lifecycle: active
+      description: Publishes and serves Python package artifacts for Railiance source and app builds.
+      default_criticality: high
+      default_data_classification: confidential
+      expected_interface_types:
+        - python-package-index
+      tags: [forge, registry, python, package]
+
+    - id: workflow-runner-substrate
+      name: Workflow runner substrate
+      lifecycle: planned
+      description: Provides forge-backed runner infrastructure, labels, placement, and credential boundaries for workflows.
+      default_criticality: high
+      default_data_classification: restricted
+      expected_interface_types:
+        - workflow-runner-label-contract
+      tags: [forge, runner, actions, automation]
+
+    - id: artifact-promotion-evidence
+      name: Artifact promotion evidence
+      lifecycle: active
+      description: Provides release artifact identity, provenance, publish, restore, and readiness evidence for consumers.
+      default_criticality: high
+      default_data_classification: internal
+      expected_interface_types:
+        - evidence-contract
+      tags: [forge, evidence, provenance, release]
+
    - id: audit-event-sink
      name: Audit/event sink
      lifecycle: planned
--- a/catalog/interface-types.yaml
+++ b/catalog/interface-types.yaml
@@ -57,6 +57,14 @@ spec:
      typical_auth_methods: [kubernetes_service_account]
      versioning: group, version, and kind.

+    - id: kubernetes-api
+      name: Kubernetes API
+      lifecycle: active
+      description: Kubernetes API server surface consumed by operators, controllers, and automation.
+      category: kubernetes
+      typical_auth_methods: [kubernetes_service_account, oidc, static_secret]
+      versioning: Kubernetes version, API groups, RBAC contract, and kubeconfig delivery path.
+
    - id: helm-release
      name: Helm release
      lifecycle: active
@@ -81,6 +89,54 @@ spec:
      typical_auth_methods: [database_role, static_secret, openbao_token]
      versioning: engine version, connection contract, and migration compatibility.

+    - id: git-ssh
+      name: Git SSH
+      lifecycle: active
+      description: Git-over-SSH repository access endpoint.
+      category: source-control
+      typical_auth_methods: [static_secret, unknown]
+      versioning: hostname, port, SSH host key, authorized key scope, and Git server compatibility.
+
+    - id: oci-registry
+      name: OCI registry
+      lifecycle: active
+      description: OCI distribution-compatible container image registry endpoint.
+      category: registry
+      typical_auth_methods: [api_key, static_secret, none]
+      versioning: registry host, API behavior, package visibility, and tag/digest semantics.
+
+    - id: python-package-index
+      name: Python package index
+      lifecycle: active
+      description: Python package index endpoint compatible with pip/uv simple API consumption.
+      category: registry
+      typical_auth_methods: [api_key, static_secret, none]
+      versioning: package index URL, package visibility, token scope, and package version semantics.
+
+    - id: workflow-runner-label-contract
+      name: Workflow runner label contract
+      lifecycle: planned
+      description: Published runner label, placement, and trust contract consumed by CI/CD workflows.
+      category: automation
+      typical_auth_methods: [none, kubernetes_service_account, static_secret]
+      versioning: semantic label names, trust level, credential purpose, and runner replacement rules.
+
+    - id: workflow-template-contract
+      name: Workflow template contract
+      lifecycle: planned
+      description: Reusable CI/CD workflow template or template catalog contract.
+      category: automation
+      typical_auth_methods: [none]
+      versioning: template id, input schema, runner labels, and release gate semantics.
+
+    - id: evidence-contract
+      name: Evidence contract
+      lifecycle: active
+      description: Documented evidence bundle or machine-readable evidence contract for release, restore, or readiness decisions.
+      category: evidence
+      typical_auth_methods: [none, api_key]
+      versioning: evidence schema version, required fields, source links, and retention policy.
+
    - id: object-storage-bucket
      name: Object-storage bucket
      lifecycle: planned
--- a/fabric/bindings/railiance-apps-artifact-evidence-forge.yaml
+++ b/fabric/bindings/railiance-apps-artifact-evidence-forge.yaml
@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: railiance-apps.s5-releases.artifact-evidence-to-forge
+  name: S5 artifact evidence binding
+  owner: railiance-apps
+  repo: railiance-apps
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: railiance-apps.s5-releases.needs-artifact-evidence
+  provider_capability_id: railiance-forge.source-forge.artifact-promotion-evidence
+  provider_interface_id: railiance-forge.source-forge.evidence-contract
+  status: compatible
+  rationale: S5 release readiness should cite forge-owned artifact publish, restore, and operating evidence.
--- a/fabric/bindings/railiance-apps-container-registry-forge.yaml
+++ b/fabric/bindings/railiance-apps-container-registry-forge.yaml
@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: railiance-apps.s5-releases.container-registry-to-forge
+  name: S5 container registry binding
+  owner: railiance-apps
+  repo: railiance-apps
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: railiance-apps.s5-releases.needs-container-registry
+  provider_capability_id: railiance-forge.source-forge.container-registry
+  provider_interface_id: railiance-forge.source-forge.oci-registry
+  status: compatible
+  rationale: S5 releases consume already-published app images from the forge-owned OCI registry.
--- a/fabric/bindings/railiance-enablement-runner-substrate-forge.yaml
+++ b/fabric/bindings/railiance-enablement-runner-substrate-forge.yaml
@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: railiance-enablement.delivery-templates.runner-substrate-to-forge
+  name: Enablement runner substrate binding
+  owner: railiance-enablement
+  repo: railiance-enablement
+  domain: railiance
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  dependency_id: railiance-enablement.delivery-templates.needs-runner-substrate
+  provider_capability_id: railiance-forge.source-forge.workflow-runner-substrate
+  provider_interface_id: railiance-forge.source-forge.runner-label-contract
+  status: compatible
+  rationale: S4 reusable templates should consume forge-owned runner labels, trust posture, and runner evidence.
--- a/fabric/bindings/railiance-forge-kubernetes-runtime-cluster.yaml
+++ b/fabric/bindings/railiance-forge-kubernetes-runtime-cluster.yaml
@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: railiance-forge.source-forge.kubernetes-runtime-to-cluster
+  name: Forge Kubernetes runtime binding
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: railiance-forge.source-forge.needs-kubernetes-runtime
+  provider_capability_id: railiance-cluster.kubernetes.runtime
+  provider_interface_id: railiance-cluster.kubernetes.api
+  status: compatible
+  rationale: The forge runtime is deployed on the Railiance Kubernetes runtime provided by railiance-cluster.
--- a/fabric/bindings/railiance-forge-object-storage-artifact-store.yaml
+++ b/fabric/bindings/railiance-forge-object-storage-artifact-store.yaml
@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: railiance-forge.source-forge.object-storage-to-artifact-store
+  name: Forge object storage binding
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  dependency_id: railiance-forge.source-forge.needs-object-storage
+  provider_capability_id: artifact-store.object-storage
+  provider_interface_id: artifact-store.object-storage.bucket
+  status: compatible
+  rationale: Durable forge artifact/blob preservation should use the planned Railiance object-storage provider rather than ad hoc forge-local storage.
--- a/fabric/bindings/railiance-forge-postgresql-cnpg.yaml
+++ b/fabric/bindings/railiance-forge-postgresql-cnpg.yaml
@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: railiance-forge.source-forge.postgresql-to-cnpg
+  name: Forge PostgreSQL binding
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: railiance-forge.source-forge.needs-postgresql
+  provider_capability_id: railiance-platform.cnpg.postgresql
+  provider_interface_id: railiance-platform.cnpg.database-connection
+  status: compatible
+  rationale: Current Gitea database state is backed by the Railiance platform CNPG PostgreSQL service.
--- a/fabric/bindings/railiance-forge-runtime-secrets-openbao.yaml
+++ b/fabric/bindings/railiance-forge-runtime-secrets-openbao.yaml
@@ -0,0 +1,16 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: BindingAssertion
+metadata:
+  id: railiance-forge.source-forge.runtime-secrets-to-openbao
+  name: Forge runtime secrets binding
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  dependency_id: railiance-forge.source-forge.needs-runtime-secrets
+  provider_capability_id: railiance-platform.openbao.runtime-secrets
+  provider_interface_id: railiance-platform.openbao.kv-v2
+  status: compatible
+  rationale: Runtime secret custody for forge workloads belongs to the platform OpenBao path; SOPS/age remains bootstrap only.
--- a/fabric/capabilities/railiance-cluster-kubernetes-runtime.yaml
+++ b/fabric/capabilities/railiance-cluster-kubernetes-runtime.yaml
@@ -0,0 +1,21 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: CapabilityDeclaration
+metadata:
+  id: railiance-cluster.kubernetes.runtime
+  name: Kubernetes runtime
+  owner: railiance-cluster
+  repo: railiance-cluster
+  domain: railiance
+  source_links:
+    - label: Cluster scope
+      path: /home/worsch/railiance-cluster/SCOPE.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Provides Kubernetes runtime primitives and API access consumed by Railiance platform, forge, and app workloads.
+  capability_type: kubernetes-runtime
+  service_id: railiance-cluster.kubernetes
+  interface_ids:
+    - railiance-cluster.kubernetes.api
+  criticality: critical
+  data_classification: restricted
--- a/fabric/capabilities/railiance-enablement-ci-cd-templates.yaml
+++ b/fabric/capabilities/railiance-enablement-ci-cd-templates.yaml
@@ -0,0 +1,23 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: CapabilityDeclaration
+metadata:
+  id: railiance-enablement.delivery-templates.ci-cd-templates
+  name: CI/CD workflow templates
+  owner: railiance-enablement
+  repo: railiance-enablement
+  domain: railiance
+  source_links:
+    - label: Enablement scope
+      path: /home/worsch/railiance-enablement/SCOPE.md
+    - label: Enablement intent
+      path: /home/worsch/railiance-enablement/INTENT.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  description: Reusable Railiance workflow templates, promotion conventions, and delivery gates that consume forge runner labels and artifact evidence.
+  capability_type: ci-cd-template-catalog
+  service_id: railiance-enablement.delivery-templates
+  interface_ids:
+    - railiance-enablement.delivery-templates.workflow-template-contract
+  criticality: medium
+  data_classification: internal
--- a/fabric/capabilities/railiance-forge-artifact-promotion-evidence.yaml
+++ b/fabric/capabilities/railiance-forge-artifact-promotion-evidence.yaml
@@ -0,0 +1,23 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: CapabilityDeclaration
+metadata:
+  id: railiance-forge.source-forge.artifact-promotion-evidence
+  name: Artifact promotion evidence
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Observability and evidence contract
+      path: /home/worsch/railiance-forge/docs/observability-operating-evidence.md
+    - label: Backup and restore handoff
+      path: /home/worsch/railiance-forge/docs/backup-restore-secret-handoff.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Provides artifact identity, provenance, publish, restore, and release-readiness evidence that downstream releases can cite.
+  capability_type: artifact-promotion-evidence
+  service_id: railiance-forge.source-forge
+  interface_ids:
+    - railiance-forge.source-forge.evidence-contract
+  criticality: high
+  data_classification: internal
--- a/fabric/capabilities/railiance-forge-container-registry.yaml
+++ b/fabric/capabilities/railiance-forge-container-registry.yaml
@@ -0,0 +1,21 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: CapabilityDeclaration
+metadata:
+  id: railiance-forge.source-forge.container-registry
+  name: Container registry
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Container registry docs
+      path: /home/worsch/railiance-forge/docs/gitea-container-registry.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Provides the Gitea OCI container registry endpoint used by Railiance workloads.
+  capability_type: container-registry
+  service_id: railiance-forge.source-forge
+  interface_ids:
+    - railiance-forge.source-forge.oci-registry
+  criticality: high
+  data_classification: confidential
--- a/fabric/capabilities/railiance-forge-python-package-registry.yaml
+++ b/fabric/capabilities/railiance-forge-python-package-registry.yaml
@@ -0,0 +1,21 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: CapabilityDeclaration
+metadata:
+  id: railiance-forge.source-forge.python-package-registry
+  name: Python package registry
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Package registry docs
+      path: /home/worsch/railiance-forge/docs/gitea-package-registry.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Provides the Gitea Python package registry endpoint used by Railiance source and app builds.
+  capability_type: python-package-registry
+  service_id: railiance-forge.source-forge
+  interface_ids:
+    - railiance-forge.source-forge.python-package-index
+  criticality: high
+  data_classification: confidential
--- a/fabric/capabilities/railiance-forge-source-hosting.yaml
+++ b/fabric/capabilities/railiance-forge-source-hosting.yaml
@@ -0,0 +1,22 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: CapabilityDeclaration
+metadata:
+  id: railiance-forge.source-forge.source-hosting
+  name: Source hosting
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Forge scope
+      path: /home/worsch/railiance-forge/SCOPE.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Hosts Railiance Git repositories, review surfaces, repository metadata, and source-forge access paths.
+  capability_type: source-hosting
+  service_id: railiance-forge.source-forge
+  interface_ids:
+    - railiance-forge.source-forge.web-ui
+    - railiance-forge.source-forge.git-ssh
+  criticality: high
+  data_classification: confidential
--- a/fabric/capabilities/railiance-forge-workflow-runner-substrate.yaml
+++ b/fabric/capabilities/railiance-forge-workflow-runner-substrate.yaml
@@ -0,0 +1,21 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: CapabilityDeclaration
+metadata:
+  id: railiance-forge.source-forge.workflow-runner-substrate
+  name: Workflow runner substrate
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Runner ownership contract
+      path: /home/worsch/railiance-forge/docs/ci-runner-actions-gitops-ownership.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  description: Provides forge-backed runner labels, placement, credential boundaries, and runner health evidence consumed by workflow templates and release checks.
+  capability_type: workflow-runner-substrate
+  service_id: railiance-forge.source-forge
+  interface_ids:
+    - railiance-forge.source-forge.runner-label-contract
+  criticality: high
+  data_classification: restricted
--- a/fabric/dependencies/railiance-apps-artifact-evidence.yaml
+++ b/fabric/dependencies/railiance-apps-artifact-evidence.yaml
@@ -0,0 +1,30 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: DependencyDeclaration
+metadata:
+  id: railiance-apps.s5-releases.needs-artifact-evidence
+  name: S5 artifact evidence dependency
+  owner: railiance-apps
+  repo: railiance-apps
+  domain: railiance
+  source_links:
+    - label: Apps scope
+      path: /home/worsch/railiance-apps/SCOPE.md
+    - label: Observability and evidence contract
+      path: /home/worsch/railiance-forge/docs/observability-operating-evidence.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  consumer_service_id: railiance-apps.s5-releases
+  requires:
+    capability_type: artifact-promotion-evidence
+    capability_id: railiance-forge.source-forge.artifact-promotion-evidence
+  interface:
+    type: evidence-contract
+    version_constraint: ">=v1"
+  auth:
+    method: none
+  criticality: high
+  data_classification: internal
+  fallback:
+    mode: manual
+    description: App operators can record manual evidence, but S5 should cite forge-owned artifact readiness when promoting releases.
--- a/fabric/dependencies/railiance-apps-container-registry.yaml
+++ b/fabric/dependencies/railiance-apps-container-registry.yaml
@@ -0,0 +1,30 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: DependencyDeclaration
+metadata:
+  id: railiance-apps.s5-releases.needs-container-registry
+  name: S5 container registry dependency
+  owner: railiance-apps
+  repo: railiance-apps
+  domain: railiance
+  source_links:
+    - label: Apps scope
+      path: /home/worsch/railiance-apps/SCOPE.md
+    - label: Container registry docs
+      path: /home/worsch/railiance-forge/docs/gitea-container-registry.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  consumer_service_id: railiance-apps.s5-releases
+  requires:
+    capability_type: container-registry
+    capability_id: railiance-forge.source-forge.container-registry
+  interface:
+    type: oci-registry
+    version_constraint: ">=registry-v2"
+  auth:
+    method: api_key
+  criticality: high
+  data_classification: confidential
+  fallback:
+    mode: none
+    description: S5 releases require a reachable container registry for private or internal app images.
--- a/fabric/dependencies/railiance-enablement-runner-substrate.yaml
+++ b/fabric/dependencies/railiance-enablement-runner-substrate.yaml
@@ -0,0 +1,30 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: DependencyDeclaration
+metadata:
+  id: railiance-enablement.delivery-templates.needs-runner-substrate
+  name: Enablement runner substrate dependency
+  owner: railiance-enablement
+  repo: railiance-enablement
+  domain: railiance
+  source_links:
+    - label: Enablement scope
+      path: /home/worsch/railiance-enablement/SCOPE.md
+    - label: Runner ownership contract
+      path: /home/worsch/railiance-forge/docs/ci-runner-actions-gitops-ownership.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  consumer_service_id: railiance-enablement.delivery-templates
+  requires:
+    capability_type: workflow-runner-substrate
+    capability_id: railiance-forge.source-forge.workflow-runner-substrate
+  interface:
+    type: workflow-runner-label-contract
+    version_constraint: ">=v1"
+  auth:
+    method: none
+  criticality: high
+  data_classification: internal
+  fallback:
+    mode: manual
+    description: Reusable templates can remain draft-only until forge publishes runner labels and trust evidence.
--- a/fabric/dependencies/railiance-forge-kubernetes-runtime.yaml
+++ b/fabric/dependencies/railiance-forge-kubernetes-runtime.yaml
@@ -0,0 +1,28 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: DependencyDeclaration
+metadata:
+  id: railiance-forge.source-forge.needs-kubernetes-runtime
+  name: Forge Kubernetes runtime dependency
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Forge scope
+      path: /home/worsch/railiance-forge/SCOPE.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  consumer_service_id: railiance-forge.source-forge
+  requires:
+    capability_type: kubernetes-runtime
+    capability_id: railiance-cluster.kubernetes.runtime
+  interface:
+    type: kubernetes-api
+    version_constraint: ">=v1"
+  auth:
+    method: kubernetes_service_account
+  criticality: critical
+  data_classification: restricted
+  fallback:
+    mode: none
+    description: The forge runtime cannot operate without the Railiance Kubernetes runtime.
--- a/fabric/dependencies/railiance-forge-object-storage.yaml
+++ b/fabric/dependencies/railiance-forge-object-storage.yaml
@@ -0,0 +1,30 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: DependencyDeclaration
+metadata:
+  id: railiance-forge.source-forge.needs-object-storage
+  name: Forge object storage dependency
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Backup and restore handoff
+      path: /home/worsch/railiance-forge/docs/backup-restore-secret-handoff.md
+    - label: Platform OpenBao object-storage handoff
+      path: /home/worsch/railiance-platform/docs/openbao.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  consumer_service_id: railiance-forge.source-forge
+  requires:
+    capability_type: object-storage
+    capability_id: artifact-store.object-storage
+  interface:
+    type: object-storage-bucket
+    version_constraint: ">=v1"
+  auth:
+    method: sts_token
+  criticality: high
+  data_classification: confidential
+  fallback:
+    mode: manual
+    description: Current Gitea package blobs remain on PVC until durable object-storage backup or artifact preservation is proven.
--- a/fabric/dependencies/railiance-forge-postgresql.yaml
+++ b/fabric/dependencies/railiance-forge-postgresql.yaml
@@ -0,0 +1,28 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: DependencyDeclaration
+metadata:
+  id: railiance-forge.source-forge.needs-postgresql
+  name: Forge PostgreSQL dependency
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Backup and restore handoff
+      path: /home/worsch/railiance-forge/docs/backup-restore-secret-handoff.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  consumer_service_id: railiance-forge.source-forge
+  requires:
+    capability_type: postgresql-database-service
+    capability_id: railiance-platform.cnpg.postgresql
+  interface:
+    type: database-connection
+    version_constraint: ">=v16"
+  auth:
+    method: database_role
+  criticality: critical
+  data_classification: confidential
+  fallback:
+    mode: none
+    description: The forge runtime requires the Gitea database state and cannot degrade safely without it.
--- a/fabric/dependencies/railiance-forge-runtime-secrets.yaml
+++ b/fabric/dependencies/railiance-forge-runtime-secrets.yaml
@@ -0,0 +1,28 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: DependencyDeclaration
+metadata:
+  id: railiance-forge.source-forge.needs-runtime-secrets
+  name: Forge runtime secrets dependency
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Backup and restore handoff
+      path: /home/worsch/railiance-forge/docs/backup-restore-secret-handoff.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  consumer_service_id: railiance-forge.source-forge
+  requires:
+    capability_type: runtime-secrets
+    capability_id: railiance-platform.openbao.runtime-secrets
+  interface:
+    type: openbao-kv-v2-mount
+    version_constraint: ">=v1 <v2"
+  auth:
+    method: kubernetes_service_account
+  criticality: critical
+  data_classification: secret
+  fallback:
+    mode: manual
+    description: SOPS/age bootstrap can carry encrypted deploy input, but runtime secret custody belongs to the platform path.
--- a/fabric/interfaces/railiance-cluster-kubernetes-api.yaml
+++ b/fabric/interfaces/railiance-cluster-kubernetes-api.yaml
@@ -0,0 +1,23 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-cluster.kubernetes.api
+  name: Kubernetes API
+  owner: railiance-cluster
+  repo: railiance-cluster
+  domain: railiance
+  source_links:
+    - label: Cluster scope
+      path: /home/worsch/railiance-cluster/SCOPE.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Kubernetes API surface and RBAC-controlled runtime contract consumed by Railiance workloads and operators.
+  interface_type: kubernetes-api
+  version: v1
+  service_id: railiance-cluster.kubernetes
+  capability_ids:
+    - railiance-cluster.kubernetes.runtime
+  auth:
+    method: kubernetes_service_account
+  data_classification: restricted
--- a/fabric/interfaces/railiance-enablement-workflow-template-contract.yaml
+++ b/fabric/interfaces/railiance-enablement-workflow-template-contract.yaml
@@ -0,0 +1,23 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-enablement.delivery-templates.workflow-template-contract
+  name: Workflow template contract
+  owner: railiance-enablement
+  repo: railiance-enablement
+  domain: railiance
+  source_links:
+    - label: Enablement scope
+      path: /home/worsch/railiance-enablement/SCOPE.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  description: Template contract for reusable Railiance CI/CD and GitOps workflow patterns.
+  interface_type: workflow-template-contract
+  version: v1
+  service_id: railiance-enablement.delivery-templates
+  capability_ids:
+    - railiance-enablement.delivery-templates.ci-cd-templates
+  auth:
+    method: none
+  data_classification: internal
--- a/fabric/interfaces/railiance-forge-evidence-contract.yaml
+++ b/fabric/interfaces/railiance-forge-evidence-contract.yaml
@@ -0,0 +1,23 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-forge.source-forge.evidence-contract
+  name: Forge evidence contract
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Observability and evidence contract
+      path: /home/worsch/railiance-forge/docs/observability-operating-evidence.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Release-readiness, artifact promotion, restore, storage, and operating evidence contract for forge consumers.
+  interface_type: evidence-contract
+  version: v1
+  service_id: railiance-forge.source-forge
+  capability_ids:
+    - railiance-forge.source-forge.artifact-promotion-evidence
+  auth:
+    method: none
+  data_classification: internal
--- a/fabric/interfaces/railiance-forge-git-ssh.yaml
+++ b/fabric/interfaces/railiance-forge-git-ssh.yaml
@@ -0,0 +1,25 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-forge.source-forge.git-ssh
+  name: Git SSH endpoint
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Observability and evidence contract
+      path: /home/worsch/railiance-forge/docs/observability-operating-evidence.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  description: Git-over-SSH endpoint contract for repository clone, fetch, and push operations when exposed.
+  interface_type: git-ssh
+  version: gitea-current
+  service_id: railiance-forge.source-forge
+  capability_ids:
+    - railiance-forge.source-forge.source-hosting
+  endpoint:
+    notes: Record the published SSH host and port once the endpoint is verified.
+  auth:
+    method: static_secret
+  data_classification: confidential
--- a/fabric/interfaces/railiance-forge-oci-registry.yaml
+++ b/fabric/interfaces/railiance-forge-oci-registry.yaml
@@ -0,0 +1,28 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-forge.source-forge.oci-registry
+  name: Gitea OCI registry
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Container registry docs
+      path: /home/worsch/railiance-forge/docs/gitea-container-registry.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: OCI registry endpoint served by current Gitea for Railiance container images.
+  interface_type: oci-registry
+  version: registry-v2
+  service_id: railiance-forge.source-forge
+  capability_ids:
+    - railiance-forge.source-forge.container-registry
+  endpoint:
+    url: https://gitea.coulomb.social/v2/
+  auth:
+    method: api_key
+    scopes:
+      - package:read
+      - package:write
+  data_classification: confidential
--- a/fabric/interfaces/railiance-forge-python-package-index.yaml
+++ b/fabric/interfaces/railiance-forge-python-package-index.yaml
@@ -0,0 +1,28 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-forge.source-forge.python-package-index
+  name: Gitea Python package index
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Package registry docs
+      path: /home/worsch/railiance-forge/docs/gitea-package-registry.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Python package index endpoint served by current Gitea for internal Railiance packages.
+  interface_type: python-package-index
+  version: simple-api
+  service_id: railiance-forge.source-forge
+  capability_ids:
+    - railiance-forge.source-forge.python-package-registry
+  endpoint:
+    url: https://gitea.coulomb.social/api/packages/coulomb/pypi/simple/
+  auth:
+    method: api_key
+    scopes:
+      - package:read
+      - package:write
+  data_classification: confidential
--- a/fabric/interfaces/railiance-forge-runner-label-contract.yaml
+++ b/fabric/interfaces/railiance-forge-runner-label-contract.yaml
@@ -0,0 +1,23 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-forge.source-forge.runner-label-contract
+  name: Runner label contract
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Runner ownership contract
+      path: /home/worsch/railiance-forge/docs/ci-runner-actions-gitops-ownership.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  description: Semantic runner labels, placement, trust levels, and credential boundaries consumed by workflow templates and release checks.
+  interface_type: workflow-runner-label-contract
+  version: v1
+  service_id: railiance-forge.source-forge
+  capability_ids:
+    - railiance-forge.source-forge.workflow-runner-substrate
+  auth:
+    method: none
+  data_classification: internal
--- a/fabric/interfaces/railiance-forge-web-ui.yaml
+++ b/fabric/interfaces/railiance-forge-web-ui.yaml
@@ -0,0 +1,25 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: InterfaceDeclaration
+metadata:
+  id: railiance-forge.source-forge.web-ui
+  name: Source forge web UI
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Observability and evidence contract
+      path: /home/worsch/railiance-forge/docs/observability-operating-evidence.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Current Gitea web UI and HTTP endpoint for source hosting and package workflows.
+  interface_type: web-ui
+  version: gitea-current
+  service_id: railiance-forge.source-forge
+  capability_ids:
+    - railiance-forge.source-forge.source-hosting
+  endpoint:
+    url: https://gitea.coulomb.social/
+  auth:
+    method: unknown
+  data_classification: confidential
--- a/fabric/services/railiance-apps-s5-releases.yaml
+++ b/fabric/services/railiance-apps-s5-releases.yaml
@@ -0,0 +1,18 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: ServiceDeclaration
+metadata:
+  id: railiance-apps.s5-releases
+  name: Railiance S5 app releases
+  owner: railiance-apps
+  repo: railiance-apps
+  domain: railiance
+  source_links:
+    - label: Apps scope
+      path: /home/worsch/railiance-apps/SCOPE.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: S5 application release surface that consumes forge artifacts, app manifests, runbooks, dry-runs, and smoke evidence.
+  service_type: app-release-surface
+  provides_capabilities: []
+  exposes_interfaces: []
--- a/fabric/services/railiance-cluster-kubernetes.yaml
+++ b/fabric/services/railiance-cluster-kubernetes.yaml
@@ -0,0 +1,20 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: ServiceDeclaration
+metadata:
+  id: railiance-cluster.kubernetes
+  name: Railiance Kubernetes runtime
+  owner: railiance-cluster
+  repo: railiance-cluster
+  domain: railiance
+  source_links:
+    - label: Cluster scope
+      path: /home/worsch/railiance-cluster/SCOPE.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Kubernetes runtime layer that provides the API server, namespaces, workloads, Services, Ingresses, and controller substrate for Railiance services.
+  service_type: cluster-runtime
+  provides_capabilities:
+    - railiance-cluster.kubernetes.runtime
+  exposes_interfaces:
+    - railiance-cluster.kubernetes.api
--- a/fabric/services/railiance-enablement-delivery-templates.yaml
+++ b/fabric/services/railiance-enablement-delivery-templates.yaml
@@ -0,0 +1,22 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: ServiceDeclaration
+metadata:
+  id: railiance-enablement.delivery-templates
+  name: Railiance delivery templates
+  owner: railiance-enablement
+  repo: railiance-enablement
+  domain: railiance
+  source_links:
+    - label: Enablement scope
+      path: /home/worsch/railiance-enablement/SCOPE.md
+    - label: Enablement intent
+      path: /home/worsch/railiance-enablement/INTENT.md
+spec:
+  lifecycle: planned
+  environments: [dev, staging, prod]
+  description: Reusable CI/CD and GitOps workflow template surface for Railiance workload delivery.
+  service_type: enablement-template-surface
+  provides_capabilities:
+    - railiance-enablement.delivery-templates.ci-cd-templates
+  exposes_interfaces:
+    - railiance-enablement.delivery-templates.workflow-template-contract
--- a/fabric/services/railiance-forge-source-forge.yaml
+++ b/fabric/services/railiance-forge-source-forge.yaml
@@ -0,0 +1,31 @@
+apiVersion: railiance.fabric/v1alpha1
+kind: ServiceDeclaration
+metadata:
+  id: railiance-forge.source-forge
+  name: Railiance source forge
+  owner: railiance-forge
+  repo: railiance-forge
+  domain: railiance
+  source_links:
+    - label: Forge scope
+      path: /home/worsch/railiance-forge/SCOPE.md
+    - label: Forge intent
+      path: /home/worsch/railiance-forge/INTENT.md
+spec:
+  lifecycle: active
+  environments: [dev, staging, prod]
+  description: Current Gitea source forge and future Forgejo migration surface for source hosting, registries, runner substrate, and release artifact evidence.
+  service_type: forge-runtime
+  provides_capabilities:
+    - railiance-forge.source-forge.source-hosting
+    - railiance-forge.source-forge.container-registry
+    - railiance-forge.source-forge.python-package-registry
+    - railiance-forge.source-forge.workflow-runner-substrate
+    - railiance-forge.source-forge.artifact-promotion-evidence
+  exposes_interfaces:
+    - railiance-forge.source-forge.web-ui
+    - railiance-forge.source-forge.git-ssh
+    - railiance-forge.source-forge.oci-registry
+    - railiance-forge.source-forge.python-package-index
+    - railiance-forge.source-forge.runner-label-contract
+    - railiance-forge.source-forge.evidence-contract
--- a/workplans/ADHOC-2026-05-25.md
+++ b/workplans/ADHOC-2026-05-25.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: railiance
 created: "2026-05-25"
 updated: "2026-05-25"
+state_hub_workstream_id: "77e80432-9548-4ac8-9654-7beb931741e4"
 ---

 # ADHOC-2026-05-25 - Ad Hoc Fixes
@@ -19,6 +20,7 @@ updated: "2026-05-25"
 id: ADHOC-2026-05-25-T01
 status: done
 priority: medium
+state_hub_task_id: "f0b4fdfa-9c26-4f8a-9372-90242eeec5d8"
 ```

 The graph explorer now lays zone subgraphs out as a grid inside each zone
--- a/workplans/ADHOC-2026-06-03.md
+++ b/workplans/ADHOC-2026-06-03.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: railiance
 created: "2026-06-03"
 updated: "2026-06-03"
+state_hub_workstream_id: "c39b02dd-8074-4efd-ad18-add5595bf646"
 ---

 # ADHOC-2026-06-03 - Ad Hoc Fixes
@@ -19,6 +20,7 @@ updated: "2026-06-03"
 id: ADHOC-2026-06-03-T01
 status: done
 priority: medium
+state_hub_task_id: "5605e418-95f4-4658-8021-9ee6f00de537"
 ```

 The graph explorer is served by the registry HTTP service, but starting it
--- a/workplans/RAIL-FAB-WP-0023-zone-drag-interaction.md
+++ b/workplans/RAIL-FAB-WP-0023-zone-drag-interaction.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: railiance-fabric
 created: "2026-05-25"
 updated: "2026-05-25"
+state_hub_workstream_id: "f02e14c5-e60f-4950-b1a2-682c38b30431"
 ---

 # Improve Zone Labels And Dragging
@@ -32,6 +33,7 @@ Fabric graph unchanged.
 id: RAIL-FAB-WP-0023-T01
 status: done
 priority: high
+state_hub_task_id: "cb31f964-9e25-483d-b2b3-c4acc7a1033a"
 ```

 Change zone labels from framed button badges to plain text in the upper-left
@@ -59,6 +61,7 @@ labels read as text on the zone surface.
 id: RAIL-FAB-WP-0023-T02
 status: done
 priority: high
+state_hub_task_id: "84de3a0d-2ab9-4775-b026-87646ea14176"
 ```

 Add a zone drag interaction that moves all currently attached visible member
@@ -87,6 +90,7 @@ and leaves the Fabric graph payload unchanged.
 id: RAIL-FAB-WP-0023-T03
 status: blocked
 priority: medium
+state_hub_task_id: "8793e982-8991-4cda-8259-3f981bbb9201"
 ```

 Verify the visual and interaction behavior with focused tests and a browser
--- a/workplans/RAIL-FAB-WP-0024-stable-zone-containers-and-layout.md
+++ b/workplans/RAIL-FAB-WP-0024-stable-zone-containers-and-layout.md
@@ -9,6 +9,7 @@ owner: codex
 topic_slug: railiance-fabric
 created: "2026-05-25"
 updated: "2026-05-25"
+state_hub_workstream_id: "63202459-2f73-409a-8881-307a5fc1835a"
 ---

 # Stabilize Zone Containers And Layout Zone Subgraphs
@@ -37,6 +38,7 @@ surface as a separate view concern.
 id: RAIL-FAB-WP-0024-T01
 status: done
 priority: high
+state_hub_task_id: "5e018a70-5aff-41bb-b0f9-0f59302c58ae"
 ```

 Exclude display-only/context edges, especially repository `declares` edges,
@@ -57,6 +59,7 @@ edges.
 id: RAIL-FAB-WP-0024-T02
 status: done
 priority: high
+state_hub_task_id: "ffa3f7b8-ee85-461a-89b8-007e4879171c"
 ```

 Introduce a view-level zone container state keyed by stable zone id.
@@ -83,6 +86,7 @@ from Fabric graph payload data.
 id: RAIL-FAB-WP-0024-T03
 status: done
 priority: high
+state_hub_task_id: "f2f5adfa-4de4-4606-aa9f-51dbf10c6443"
 ```

 Add a per-zone layout pass that positions assigned visible nodes inside their
@@ -110,6 +114,7 @@ separate drawing surfaces.
 id: RAIL-FAB-WP-0024-T04
 status: done
 priority: medium
+state_hub_task_id: "cd418134-cacc-42f6-a6ea-0bfd1cda9965"
 ```

 Update the graph explorer contract and run focused validation.
Author	SHA1	Message	Date
tegwick	40b409cd92	Sync fabric workplan IDs	2026-06-05 17:12:48 +02:00
tegwick	0b5d295800	Declare forge graph contracts	2026-06-05 17:10:31 +02:00