63 lines
2.3 KiB
Text
63 lines
2.3 KiB
Text
# SOW (Statement of Work) contract — governed-delivery mode, migration 0041.
|
|
# The project-side instance of a Work Order: human-ratified contracts a
|
|
# witness can execute. Validation is OPT-IN (voluntary-adoption): a plain
|
|
# record SOW works; applying `(import "sow").Sow` adds the structural gate.
|
|
# Signing stays fully out-of-band — a detached .minisig sidecar; a signature
|
|
# field must never be added here (a file cannot reference a signature
|
|
# computed over its own bytes including that reference).
|
|
|
|
let _Exempt = {
|
|
path | String,
|
|
why | String, # why this specific instance is legitimate, not a violation
|
|
} in
|
|
|
|
let _Candidate = {
|
|
path | String,
|
|
pattern | String, # what was found
|
|
remediation | String, # the fix, and why it isn't done yet
|
|
} in
|
|
|
|
let _Contract = {
|
|
id | String,
|
|
kind | [| 'static, 'runtime, 'lock, 'adversarial |],
|
|
why | String,
|
|
# Shell command; exit 0 = satisfied. Runs with cwd pinned to the governed
|
|
# repo root (the parent of .governance/) — write checks fail-closed:
|
|
# assert a file exists before inverting a grep on it.
|
|
check | String,
|
|
|
|
# standing-law fields — optional; a single-task WO never populates them.
|
|
scope | Array String | default = [],
|
|
exclude | Array String | default = [],
|
|
|
|
# A scope with known, not-yet-fixed exceptions (§7.3). When exempt is
|
|
# non-empty the check MUST emit one violating path per stdout line —
|
|
# exemption subtracts exact paths; any non-exempt remainder fails.
|
|
exempt | Array _Exempt | default = [],
|
|
candidates | Array _Candidate | default = [],
|
|
|
|
# Ratchet for gradual adoption; "" = absolute (no baseline debt tolerated).
|
|
baseline | String | default = "",
|
|
} in
|
|
|
|
{
|
|
Sow = {
|
|
id | String,
|
|
objective | String,
|
|
|
|
# §7.1 — REQUIRED: what was searched for an existing mechanism before any
|
|
# contract below was drafted. "none found, searched X/Y/Z" is a valid
|
|
# entry; an empty array is what the sow-searched-first guard rejects.
|
|
existing_mechanisms_searched | Array String,
|
|
|
|
# §7.6 — set when this SOW revision corrects an earlier Work Order;
|
|
# iteration happens ACROSS instances, never as a hidden restart within one.
|
|
predecessor_wo | String | optional,
|
|
|
|
contracts | Array _Contract,
|
|
},
|
|
|
|
Contract = _Contract,
|
|
Exempt = _Exempt,
|
|
Candidate = _Candidate,
|
|
}
|