Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
29 commits
Select commit Hold shift + click to select a range
2101bda
feat(integration): establish CWL ecosystem contract v1
seonghobae Aug 15, 2026
bfb4dd9
test(integration): expose envelope validation gaps
seonghobae Aug 15, 2026
9166c12
fix(integration): reject ambiguous event identities
seonghobae Aug 15, 2026
d69b506
fix(integration): reject ambiguous command identities
seonghobae Aug 15, 2026
d7cd3e7
docs(integration): adopt current async and trace baselines
seonghobae Aug 15, 2026
76561de
docs(doctoring): update ecosystem standards evidence
seonghobae Aug 15, 2026
c595100
docs(adr): harden ecosystem contract decision
seonghobae Aug 15, 2026
867fc15
test(integration): reject reserved trace flag bits
seonghobae Aug 15, 2026
cd53b92
fix(integration): reserve trace flag bits in event envelopes
seonghobae Aug 15, 2026
c934fb0
fix(integration): reserve trace flag bits in command envelopes
seonghobae Aug 15, 2026
f3bc1ba
docs(integration): record reserved trace flag contract
seonghobae Aug 15, 2026
89c845d
docs(integration): bind trace flag semantics in ADR
seonghobae Aug 15, 2026
21d935b
docs(integration): require zeroed reserved trace flags
seonghobae Aug 15, 2026
026debe
fix(integration): enforce strict RFC 3339 timestamps
seonghobae Aug 15, 2026
cdf97c2
test(integration): specify ecosystem catalogue contract
seonghobae Aug 15, 2026
06f67c1
feat(integration): add ecosystem capability catalogue v1
seonghobae Aug 15, 2026
043e0ed
fix(test): make catalogue helper import deterministic
seonghobae Aug 15, 2026
be84bcc
fix(integration): validate RFC 3339 leap seconds
seonghobae Aug 19, 2026
79d86ca
fix(quality): restore shared test support
seonghobae Aug 19, 2026
ca5ebaa
style(catalog): satisfy Python quality checks
seonghobae Aug 19, 2026
06ca50d
fix(catalog): preserve security product authority
seonghobae Aug 20, 2026
ec1e165
fix(catalog): preserve validator executable mode
seonghobae Aug 20, 2026
5e41f0a
Merge branch 'main' into codex/pr1016-current-main-successor
opencode-agent[bot] Aug 20, 2026
9ac03e0
fix(catalog): support package and script entrypoints
seonghobae Aug 20, 2026
db5e704
Merge branch 'main' into codex/pr1016-current-main-successor
opencode-agent[bot] Aug 20, 2026
390af19
Merge branch 'main' into codex/pr1016-current-main-successor
opencode-agent[bot] Aug 20, 2026
e15eaae
Merge branch 'main' into codex/pr1016-current-main-successor
opencode-agent[bot] Aug 21, 2026
8df0efb
fix: bind catalogue edges to provider consumers
seonghobae Aug 21, 2026
113de5e
fix(ci): refresh audit lock and scheduler assertion
seonghobae Aug 21, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 76 additions & 0 deletions .github/workflows/cwl-ecosystem-catalog-quality-ci.yml
Original file line number Diff line number Diff line change
@@ -0,0 +1,76 @@
name: CWL Ecosystem Catalogue Quality CI

on:
pull_request:
paths:
- ".github/workflows/cwl-ecosystem-catalog-quality-ci.yml"
- "CHANGELOG.md"
- "docs/doctoring/ecosystem-capability-catalog-standards.md"
- "docs/integration/CWL_REPOSITORY_RESPONSIBILITY_CATALOG.md"
- "docs/integration/README.md"
- "docs/integration/adr/README.md"
- "docs/integration/adr/0002-cwl-capability-catalog.md"
- "schemas/cwl-ecosystem-catalog-v1.schema.json"
- "schemas/cwl-service-capability-v1.schema.json"
- "schemas/examples/cwl-ecosystem-catalog-v1.example.json"
- "schemas/examples/cwl-service-capability-v1.example.json"
- "schemas/examples/services/**"
- "scripts/ci/cwl_catalog_*.py"
- "scripts/ci/validate_cwl_ecosystem_catalog.py"
- "tests/catalogue_test_helpers.py"
- "tests/test_cwl_catalog_*.py"
Comment on lines +5 to +21

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: Quality CI path filter omits conftest.py

The trigger paths in cwl-ecosystem-catalog-quality-ci.yml cover the catalogue scripts, schemas, and tests but not conftest.py, which now loads the catalogue helper the focused tests depend on. A change touching only conftest.py would not re-run this gate.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.


permissions:
contents: read

concurrency:
group: cwl-ecosystem-catalog-quality-${{ github.event.pull_request.number || github.ref }}
cancel-in-progress: true

jobs:
exact-head-catalogue-quality:
runs-on: ubuntu-24.04
timeout-minutes: 10
steps:
- name: Checkout exact source revision
uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
with:
ref: ${{ github.event.pull_request.head.sha }}
persist-credentials: false

- name: Set up Python
uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0
with:
python-version: "3.14"

- name: Install hash-verified test-only dependencies
env:
PIP_DISABLE_PIP_VERSION_CHECK: "1"
PIP_NO_INPUT: "1"
shell: bash --noprofile --norc -e -o pipefail {0}
run: |
cat >"${RUNNER_TEMP}/catalogue-quality-requirements.txt" <<'EOF'
coverage==7.15.2 --hash=sha256:b9a6367e4aff723e8ee8190836836124284e8fcd4265e307c844010cfa074f3f
iniconfig==2.1.0 --hash=sha256:9deba5723312380e77435581c6bf4935c94cbfab9b1ed33ef8d238ea168eb760
packaging==26.2 --hash=sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e
pluggy==1.6.0 --hash=sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746
pygments==2.20.0 --hash=sha256:81a9e26dd42fd28a23a2d169d86d7ac03b46e2f8b59ed4698fb4785f946d0176
pytest==9.1.1 --hash=sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c
EOF
python -m pip install --only-binary=:all: --require-hashes -r "${RUNNER_TEMP}/catalogue-quality-requirements.txt"

- name: Verify exact-head catalogue contracts
shell: bash --noprofile --norc -e -o pipefail {0}
run: |
test "$(git rev-parse HEAD)" = "${{ github.event.pull_request.head.sha }}"
python -m coverage run --branch -m pytest -q \
tests/test_cwl_catalog_contract_and_io.py \
tests/test_cwl_catalog_services.py \
tests/test_cwl_catalog_relationships_cli_docs.py
python -m coverage report \
--include='scripts/ci/cwl_catalog_*.py,scripts/ci/validate_cwl_ecosystem_catalog.py' \
--fail-under=100
Comment on lines +66 to +72

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: Catalogue quality workflow runs only 3 test files against a 100% coverage gate

The new workflow cwl-ecosystem-catalog-quality-ci.yml runs coverage over only the three catalog test files and then asserts --fail-under=100 with --include='scripts/ci/cwl_catalog_*.py,scripts/ci/validate_cwl_ecosystem_catalog.py'. This scopes the 100% gate to just the catalog modules, which is consistent with the intent, but it relies on those three files fully exercising every branch (including the if __package__: guards marked # pragma: no cover). If a future edit adds an untested branch in a catalog module, this focused job — not the full-suite coverage gate — is the one that will catch it, so the include/pragma coupling must be kept in sync.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

Comment on lines +62 to +72

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

📝 Info: Envelope-contract test not run by this workflow

The workflow runs only the three catalogue test files (.github/workflows/cwl-ecosystem-catalog-quality-ci.yml:66-69) and its path triggers omit the envelope schemas, their examples, and test_cwl_integration_contract.py added in this same PR. Those rely on the general central suite; this catalogue workflow gives the envelope contract no exact-head gate.

Open in Devin Review

Was this helpful? React with 👍 or 👎 to provide feedback.

python scripts/ci/validate_cwl_ecosystem_catalog.py \
schemas/examples/cwl-ecosystem-catalog-v1.example.json
python -m compileall -q scripts/ci tests
git diff --exit-code
3 changes: 3 additions & 0 deletions CHANGELOG.md
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,9 @@ Semantic Versioning where the repository publishes a release.
- Added an hourly organization commercial-readiness coordinator that discovers writable repositories, honors enabled dedicated writer leases and fully paginated live writer runs, refetches exact repository/workflow/run/PR state before dispatch, rotates bounded review-repair and opt-in NVIDIA OpenCode product-development targets, fails nonzero on fleet-wide inspection or dispatch outages, retains three-day JSON receipts, and keeps the existing 15-minute merge scheduler authoritative.
- Added a dedicated Quarantine Sandbox Runtime hourly caller at minute 14 that targets protected `develop`, dispatches at most one exact-head repair, applies a two-hour same-head retry floor, preserves non-cancelling single-flight execution, and maps only the established scheduler credentials with job-scoped OIDC.
- Added a dedicated OriginWeave hourly caller that invokes the product-neutral central scheduler with the exact repository, protected `main` branch, one-dispatch budget, two-hour same-head retry floor, non-cancelling single-flight heartbeat, job-scoped OIDC, and only the established scheduler credentials.
- Added the CWL repository responsibility catalogue with closed service/relationship schemas, a conservative 25-repository capability ledger, canonical EgressWeave/AppGuardrail/Wardnet/Keyverse security ownership, globally unique capability IDs, source-backed consumer direction, customer next actions, strict semantic validation, exact-head 100% statement/branch/docstring quality evidence, and CSAP/SOC 2 engineering-readiness documentation.
- Relationship validation now requires every provider-consumer edge to match the provider manifest's declared consumer repositories, preventing catalogue drift between relationship records and ownership declarations.
- Added the CWL Ecosystem Integration Contract v1 with CloudEvents-profiled event and command envelopes, OpenAPI/AsyncAPI/JSON Schema compatibility rules, UUIDv7 identifiers, temporal and provenance semantics, purpose-bound PII dereferencing, and stdlib-only contract tests for cross-repository adoption.
- Added a trusted pull-request comment router for `@cwl-noema-review` and review-only `@opencode-agent` dispatches, with an organization sweep, exact-head receipts, repository allowlisting, fixed runners, immutable checkout pins, and a permanent 100% statement/branch/docstring quality gate.
- Added an organization-owned reusable exact-artifact SBOM attestation boundary that validates inert six-file wheel/sdist evidence, binds CycloneDX 1.7 predicates to exact SHA-256 subjects, signs through least-privilege GitHub artifact attestations, and exports online and offline verification bundles.
- Added exact-base `uv.lock` materialization that reconstructs standalone nested projects with a checksum-pinned official `uv` exporter, isolated frozen/offline execution, strict exact-pin and SHA-256 output validation, and complete Python 3.10/3.14 quality evidence.
Expand Down
19 changes: 19 additions & 0 deletions docs/doctoring/ecosystem-capability-catalog-standards.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,19 @@
# Ecosystem Capability Catalogue Standards

The catalogue applies **JSON Schema Draft 2020-12** to closed machine-readable contracts, **OpenAPI 3.2.0** to new shared HTTP interfaces, **AsyncAPI 3.1.0** to asynchronous channel descriptions, **CloudEvents 1.0** to domain event identity, and **W3C PROV-O** to provenance semantics. The catalogue does not claim that schema validation proves authorization, scientific validity, deployment maturity, CSAP certification, or SOC 2 attestation.

## APA 7th references

AsyncAPI Initiative. (2024). *AsyncAPI specification 3.1.0*. https://www.asyncapi.com/docs/reference/specification/v3.1.0

Cloud Native Computing Foundation. (2024). *CloudEvents specification 1.0.2*. https://github.com/cloudevents/spec/tree/v1.0.2

JSON Schema. (2022). *JSON Schema specification: Draft 2020-12*. https://json-schema.org/draft/2020-12

OpenAPI Initiative. (2025). *OpenAPI specification 3.2.0*. https://spec.openapis.org/oas/v3.2.0.html

World Wide Web Consortium. (2013). *PROV-O: The PROV ontology*. https://www.w3.org/TR/prov-o/

American Institute of Certified Public Accountants. (2022). *Trust services criteria*. AICPA.

Korea Internet & Security Agency. (2025). *Cloud Security Assurance Program guidance*. KISA.
32 changes: 32 additions & 0 deletions docs/doctoring/ecosystem-integration-standards.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# Doctoring: CWL ecosystem integration standards

This record supports the organization-level integration profile. Product-domain scientific decisions remain in the owning repository's doctoring/research documentation.

## Design implications

- **CloudEvents 1.0** provides a vendor-neutral event data model. CWL uses CloudEvents `specversion: "1.0"` and keeps organization metadata under the event `data` object so the profile is explicit and contract-testable.
- **OpenAPI 3.2.0** is the published OpenAPI baseline for new shared synchronous interfaces.
- **AsyncAPI 3.1.0** is the current published baseline for repositories that publish asynchronous channel contracts.
- **JSON Schema Draft 2020-12** is the baseline for shared JSON contracts.
- **RFC 9457** defines Problem Details for HTTP APIs and supersedes RFC 7807.
- **RFC 9562** defines UUIDs; UUIDv7 supplies a time-ordered Unix-millisecond layout appropriate for organization-level event/command/correlation identifiers when time-ordering is useful.
- **W3C Trace Context** defines stable cross-service tracing headers. The 2021 Recommendation is used as the production baseline rather than making a draft-level successor a hard dependency. The CWL v1 envelope profile pins `traceparent` version `00`, rejects the Recommendation's forbidden all-zero trace and parent identifiers, and accepts only flags `00` or `01` because senders MUST leave every reserved flag bit unset.
- **W3C PROV-O** supplies a standard vocabulary for provenance entities, activities, and agents when products expose provenance graphs.

## APA 7th references

AsyncAPI Initiative. (2026). *AsyncAPI specification (Version 3.1.0).* https://www.asyncapi.com/docs/reference/specification/v3.1.0

Cloud Native Computing Foundation. (2022). *CloudEvents specification (Version 1.0.2).* https://github.com/cloudevents/spec/tree/v1.0.2

Davis, K., Peabody, B., & Leach, P. (2024). *Universally unique identifiers (UUIDs)* (RFC 9562). Internet Engineering Task Force. https://doi.org/10.17487/RFC9562

Lebo, T., Sahoo, S., & McGuinness, D. (Eds.). (2013). *PROV-O: The PROV ontology.* World Wide Web Consortium. https://www.w3.org/TR/prov-o/

Nottingham, M., Wilde, E., & Dalal, S. (2023). *Problem details for HTTP APIs* (RFC 9457). Internet Engineering Task Force. https://doi.org/10.17487/RFC9457

OpenAPI Initiative. (2025). *OpenAPI specification (Version 3.2.0).* Linux Foundation. https://spec.openapis.org/oas/v3.2.0.html

World Wide Web Consortium. (2021). *Trace Context.* https://www.w3.org/TR/trace-context/

Wright, A., Andrews, H., Hutton, B., & Dennis, G. (2022). *JSON Schema: A media type for describing JSON documents (Draft 2020-12).* JSON Schema. https://json-schema.org/draft/2020-12/json-schema-core
Loading
Loading