feat(contracts): add 13-seam registry (SeamDefinition instances) + validator [T6-3] - #49
Merged
Conversation
Machine-readable seam registry: 13 architectural seams (SEAM-001..013) as SeamDefinition instances (canonical schema SourceOS-Linux/sourceos-spec T0-2, vendored here with provenance). Each names the boundary, attack vector, gate requirement, status, priority, and linked repos. - contracts/seam-registry.json (the contract) - schemas/seam-definition.schema.json (vendored) - tools/validate_seam_registry.py: validate each seam + all 13 present + SEAM-013 telemetry + non-empty gate_requirements; wired into make validate - docs/seam-registry.md (human-readable) Placed in the contracts repo per direction; runtime enforcement (eBPF, boot-attestation.sh) stays in source-os (deferred to Linux env). make validate green.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements T6-3 in the contracts repo (per direction — this is where the estate's contracts live). The 13-seam registry as a machine-readable SeamDefinition contract; runtime enforcement (eBPF, boot-attestation) stays in source-os (deferred to a Linux kernel env).
What
contracts/seam-registry.json— 13 seams (SEAM-001..013) as SeamDefinition instances.schemas/seam-definition.schema.json— vendored from sourceos-spec T0-2 (canonical owner noted).tools/validate_seam_registry.py— validates each seam against the schema, asserts all 13 present, SEAM-013 references telemetry, every seam has a gate. Wired intomake validate.docs/seam-registry.md— human-readable table.Verification
make validate PY=python3→ exit 0;OK: seam registry — 13 seams validated (SEAM-001..013 present, SEAM-013 telemetry)Acceptance (T6-3)
Closes #48