45 lines
1.5 KiB
Text
45 lines
1.5 KiB
Text
# sow/laws-schema.ncl — standing-law contract for the provisioning catalog.
|
|
# Frozen design: provisioning/.coder/2026-07-03_laws-catalogo-provisioning.plan.md §3.
|
|
# Ratified rulings this schema encodes: R1 (wrks/ out of scope), R2 (in-container
|
|
# interpreters legitimate), R3 (evidence-only admission), R4 (declarative apply vs
|
|
# imperative get-decide-patch), J1 (minisign signing), J2 (L2 deferred).
|
|
#
|
|
# Signing is deliberately OUT-OF-BAND: the signature covers laws.ncl's bytes as a
|
|
# detached minisig sidecar (laws.ncl.minisig) verified against a known public key
|
|
# (~/.minisign/witness.pub). A `signature` field embedded in this record would be
|
|
# self-referential — pointing to a signature that must be computed over content
|
|
# that doesn't yet include the pointer, and invalidated by adding it after the fact.
|
|
# There is nothing to reference in-band; verification is a witness.nu convention
|
|
# (file exists + `minisign -V` against the known pubkey), not schema data.
|
|
|
|
let Status = [| 'Active, 'Deferred |] in
|
|
|
|
{
|
|
Exemption = {
|
|
path | String,
|
|
why | String,
|
|
},
|
|
|
|
Candidate = {
|
|
path | String,
|
|
pattern | String,
|
|
remediation | String,
|
|
},
|
|
|
|
Law = {
|
|
id | String,
|
|
status | Status,
|
|
why | String,
|
|
kind | [| 'static, 'runtime, 'lock |],
|
|
scope | Array String,
|
|
exclude | Array String,
|
|
check | String,
|
|
baseline | String,
|
|
exempt | Array Exemption,
|
|
candidates | Array Candidate | default = [],
|
|
},
|
|
|
|
Laws = {
|
|
laws | Array Law,
|
|
},
|
|
}
|