diff --git a/.repository-projection.json b/.repository-projection.json index 5da9849..a44e214 100644 --- a/.repository-projection.json +++ b/.repository-projection.json @@ -3,11 +3,11 @@ "projection": "api", "projectionSchemaVersion": 1, "sourceRepository": "dx-corp/mono", - "sourceSha": "2102d45bdf4cf6222425e5b03441015fa8b56026", + "sourceSha": "0135ea0655c81b1b2a8e7fb5e4fb00d827607b35", "destinationRepository": "dx-corp/api", - "priorProjectedBase": "c5a0cb3eba3ee7d6f925cc427731059da8baaf9d", + "priorProjectedBase": "c4d7654c2c9fe69d1da9ea22080477b295672aef", "definitionDigest": "144b18a5c1f3e7ee6e2d1abc32f80a97adfeacd088911ec659d63622fe85d18c", "toolDigest": "f58d71f023a4f0a27d77cb96dcc5348a40816d0b", - "contentDigest": "9c511d26160cf43067b82f99f3074eaf99f44b8b9dfe72f0d89f3e221a24984a", + "contentDigest": "ecd825d20fda2280d75beeb94a05a0dde6db315da21a4958e4024159b7824a8f", "publicationEligible": true } diff --git a/openapi/console/v1/console.openapi.yaml b/openapi/console/v1/console.openapi.yaml index 37f10e6..5a0d556 100644 --- a/openapi/console/v1/console.openapi.yaml +++ b/openapi/console/v1/console.openapi.yaml @@ -2,6 +2,42 @@ openapi: 3.1.0 info: title: console.v1 paths: + /console.v1.ConsoleService/AssessComplianceSubject: + post: + tags: + - console.v1.ConsoleService + summary: AssessComplianceSubject + description: Evaluates a versioned compliance profile against owner-fetched, tenant-scoped facts. + operationId: console.v1.ConsoleService.AssessComplianceSubject + parameters: + - name: Connect-Protocol-Version + in: header + required: true + schema: + $ref: '#/components/schemas/connect-protocol-version' + - name: Connect-Timeout-Ms + in: header + schema: + $ref: '#/components/schemas/connect-timeout-header' + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/console.v1.AssessComplianceSubjectRequest' + required: true + responses: + default: + description: Error + content: + application/json: + schema: + $ref: '#/components/schemas/connect.error' + "200": + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/console.v1.AssessComplianceSubjectResponse' /console.v1.ConsoleService/ListBusinessBlueprints: post: tags: @@ -9315,6 +9351,15 @@ components: this workspace. NOT_CONFIGURED means the deployment has no commitment-ledger origin configured, so the response carries no commitments instead of an empty ledger that would read as "you have none". + console.v1.ComplianceFindingStatus: + type: string + title: ComplianceFindingStatus + enum: + - COMPLIANCE_FINDING_STATUS_UNSPECIFIED + - COMPLIANCE_FINDING_STATUS_SATISFIED + - COMPLIANCE_FINDING_STATUS_VIOLATED + - COMPLIANCE_FINDING_STATUS_INDETERMINATE + - COMPLIANCE_FINDING_STATUS_NOT_APPLICABLE console.v1.ComputerMissionAuthorityMode: type: string title: ComputerMissionAuthorityMode @@ -11352,6 +11397,35 @@ components: required: - settings additionalProperties: false + console.v1.AssessComplianceSubjectRequest: + type: object + properties: + organizationId: + type: string + title: organization_id + workspaceId: + type: string + title: workspace_id + profileId: + type: string + title: profile_id + subjectKind: + type: string + title: subject_kind + subjectId: + type: string + title: subject_id + title: AssessComplianceSubjectRequest + additionalProperties: false + description: One versioned control profile runs against one owner-fetched subject. + console.v1.AssessComplianceSubjectResponse: + type: object + properties: + assessment: + title: assessment + $ref: '#/components/schemas/console.v1.ComplianceSubjectAssessment' + title: AssessComplianceSubjectResponse + additionalProperties: false console.v1.AttachPrivateEndpointToProfileRequest: type: object properties: @@ -14444,6 +14518,65 @@ components: required: - upload additionalProperties: false + console.v1.ComplianceRequirementFinding: + type: object + properties: + requirementId: + type: string + title: requirement_id + status: + title: status + $ref: '#/components/schemas/console.v1.ComplianceFindingStatus' + reasonCode: + type: string + title: reason_code + sourceRef: + type: string + title: source_ref + title: ComplianceRequirementFinding + additionalProperties: false + console.v1.ComplianceSubjectAssessment: + type: object + properties: + profileId: + type: string + title: profile_id + subjectKind: + type: string + title: subject_kind + subjectId: + type: string + title: subject_id + sourceDigest: + type: string + title: source_digest + sourceUpdatedAt: + title: source_updated_at + $ref: '#/components/schemas/google.protobuf.Timestamp' + assessedAt: + title: assessed_at + $ref: '#/components/schemas/google.protobuf.Timestamp' + status: + title: status + $ref: '#/components/schemas/console.v1.ComplianceFindingStatus' + findings: + type: array + items: + $ref: '#/components/schemas/console.v1.ComplianceRequirementFinding' + title: findings + inspectedCount: + type: integer + title: inspected_count + description: This route covers exactly the one requested owner record. + expectedCount: + type: integer + title: expected_count + controlId: + type: string + title: control_id + title: ComplianceSubjectAssessment + additionalProperties: false + description: A live, bounded assessment of one execution. It is not an immutable snapshot. console.v1.ComputerMission: type: object properties: diff --git a/openapi/deixic/v1/deixic.openapi.yaml b/openapi/deixic/v1/deixic.openapi.yaml index 0212180..2ea87cb 100644 --- a/openapi/deixic/v1/deixic.openapi.yaml +++ b/openapi/deixic/v1/deixic.openapi.yaml @@ -2,6 +2,42 @@ openapi: 3.1.0 info: title: deixic.v1 paths: + /deixic.v1.DeixicService/AssessComplianceSubject: + post: + tags: + - deixic.v1.DeixicService + summary: AssessComplianceSubject + description: Evaluates a versioned compliance profile against owner-fetched, tenant-scoped facts. + operationId: deixic.v1.DeixicService.AssessComplianceSubject + parameters: + - name: Connect-Protocol-Version + in: header + required: true + schema: + $ref: '#/components/schemas/connect-protocol-version' + - name: Connect-Timeout-Ms + in: header + schema: + $ref: '#/components/schemas/connect-timeout-header' + requestBody: + content: + application/json: + schema: + $ref: '#/components/schemas/console.v1.AssessComplianceSubjectRequest' + required: true + responses: + default: + description: Error + content: + application/json: + schema: + $ref: '#/components/schemas/connect.error' + "200": + description: Success + content: + application/json: + schema: + $ref: '#/components/schemas/console.v1.AssessComplianceSubjectResponse' /deixic.v1.DeixicService/ListBusinessBlueprints: post: tags: @@ -8838,6 +8874,15 @@ components: this workspace. NOT_CONFIGURED means the deployment has no commitment-ledger origin configured, so the response carries no commitments instead of an empty ledger that would read as "you have none". + console.v1.ComplianceFindingStatus: + type: string + title: ComplianceFindingStatus + enum: + - COMPLIANCE_FINDING_STATUS_UNSPECIFIED + - COMPLIANCE_FINDING_STATUS_SATISFIED + - COMPLIANCE_FINDING_STATUS_VIOLATED + - COMPLIANCE_FINDING_STATUS_INDETERMINATE + - COMPLIANCE_FINDING_STATUS_NOT_APPLICABLE console.v1.ComputerMissionAuthorityMode: type: string title: ComputerMissionAuthorityMode @@ -10741,6 +10786,35 @@ components: required: - settings additionalProperties: false + console.v1.AssessComplianceSubjectRequest: + type: object + properties: + organizationId: + type: string + title: organization_id + workspaceId: + type: string + title: workspace_id + profileId: + type: string + title: profile_id + subjectKind: + type: string + title: subject_kind + subjectId: + type: string + title: subject_id + title: AssessComplianceSubjectRequest + additionalProperties: false + description: One versioned control profile runs against one owner-fetched subject. + console.v1.AssessComplianceSubjectResponse: + type: object + properties: + assessment: + title: assessment + $ref: '#/components/schemas/console.v1.ComplianceSubjectAssessment' + title: AssessComplianceSubjectResponse + additionalProperties: false console.v1.AttachPrivateEndpointToProfileRequest: type: object properties: @@ -13833,6 +13907,65 @@ components: required: - upload additionalProperties: false + console.v1.ComplianceRequirementFinding: + type: object + properties: + requirementId: + type: string + title: requirement_id + status: + title: status + $ref: '#/components/schemas/console.v1.ComplianceFindingStatus' + reasonCode: + type: string + title: reason_code + sourceRef: + type: string + title: source_ref + title: ComplianceRequirementFinding + additionalProperties: false + console.v1.ComplianceSubjectAssessment: + type: object + properties: + profileId: + type: string + title: profile_id + subjectKind: + type: string + title: subject_kind + subjectId: + type: string + title: subject_id + sourceDigest: + type: string + title: source_digest + sourceUpdatedAt: + title: source_updated_at + $ref: '#/components/schemas/google.protobuf.Timestamp' + assessedAt: + title: assessed_at + $ref: '#/components/schemas/google.protobuf.Timestamp' + status: + title: status + $ref: '#/components/schemas/console.v1.ComplianceFindingStatus' + findings: + type: array + items: + $ref: '#/components/schemas/console.v1.ComplianceRequirementFinding' + title: findings + inspectedCount: + type: integer + title: inspected_count + description: This route covers exactly the one requested owner record. + expectedCount: + type: integer + title: expected_count + controlId: + type: string + title: control_id + title: ComplianceSubjectAssessment + additionalProperties: false + description: A live, bounded assessment of one execution. It is not an immutable snapshot. console.v1.ComputerMission: type: object properties: diff --git a/proto/console/v1/console.proto b/proto/console/v1/console.proto index ea50d86..35b0ca3 100644 --- a/proto/console/v1/console.proto +++ b/proto/console/v1/console.proto @@ -26,6 +26,13 @@ option go_package = "github.com/evalops/platform/gen/go/console/v1;consolev1"; // governance, usage, integrations, and posture without exposing protocol // details such as MCP as the primary product contract. service ConsoleService { + // Evaluates a versioned compliance profile against owner-fetched, tenant-scoped facts. + rpc AssessComplianceSubject(AssessComplianceSubjectRequest) returns (AssessComplianceSubjectResponse) { + option (common.v1.required_scopes) = "console:read"; + option (common.v1.organization_scope_field) = "organization_id"; + option (common.v1.workspace_scope_field) = "workspace_id"; + option (common.v1.risk_level) = RISK_LEVEL_LOW; + } // Lists built-in native business blueprints available to every authorized tenant. rpc ListBusinessBlueprints(ListBusinessBlueprintsRequest) returns (ListBusinessBlueprintsResponse) { option (common.v1.required_scopes) = "console:read"; @@ -11029,3 +11036,47 @@ message StaffProductIssueRecoverySummary { google.protobuf.Timestamp created_at = 8; string last_reply = 9 [(common.v1.classification) = DATA_CLASSIFICATION_CONTENT]; } + +// One versioned control profile runs against one owner-fetched subject. +message AssessComplianceSubjectRequest { + string organization_id = 1 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER]; + string workspace_id = 2 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER]; + string profile_id = 3 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE]; + string subject_kind = 4 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE]; + string subject_id = 5 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER]; +} + +enum ComplianceFindingStatus { + COMPLIANCE_FINDING_STATUS_UNSPECIFIED = 0; + COMPLIANCE_FINDING_STATUS_SATISFIED = 1; + COMPLIANCE_FINDING_STATUS_VIOLATED = 2; + COMPLIANCE_FINDING_STATUS_INDETERMINATE = 3; + COMPLIANCE_FINDING_STATUS_NOT_APPLICABLE = 4; +} + +message ComplianceRequirementFinding { + string requirement_id = 1 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE]; + ComplianceFindingStatus status = 2; + string reason_code = 3 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE]; + string source_ref = 4 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER]; +} + +// A live, bounded assessment of one execution. It is not an immutable snapshot. +message ComplianceSubjectAssessment { + string profile_id = 1 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE]; + string subject_kind = 2 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE]; + string subject_id = 3 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER]; + string source_digest = 4 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER]; + google.protobuf.Timestamp source_updated_at = 5; + google.protobuf.Timestamp assessed_at = 6; + ComplianceFindingStatus status = 7; + repeated ComplianceRequirementFinding findings = 8; + // This route covers exactly the one requested owner record. + uint32 inspected_count = 9; + uint32 expected_count = 10; + string control_id = 11 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE]; +} + +message AssessComplianceSubjectResponse { + ComplianceSubjectAssessment assessment = 1; +} diff --git a/proto/deixic/v1/deixic.proto b/proto/deixic/v1/deixic.proto index df63906..00ab699 100644 --- a/proto/deixic/v1/deixic.proto +++ b/proto/deixic/v1/deixic.proto @@ -11,6 +11,13 @@ option go_package = "github.com/evalops/platform/gen/go/deixic/v1;deixicv1"; // DeixicService is the producer-owned browser contract served by Platform API. // Canonical message schemas remain in console.v1 for wire compatibility. service DeixicService { + // Evaluates a versioned compliance profile against owner-fetched, tenant-scoped facts. + rpc AssessComplianceSubject(console.v1.AssessComplianceSubjectRequest) returns (console.v1.AssessComplianceSubjectResponse) { + option (common.v1.required_scopes) = "console:read"; + option (common.v1.organization_scope_field) = "organization_id"; + option (common.v1.workspace_scope_field) = "workspace_id"; + option (common.v1.risk_level) = RISK_LEVEL_LOW; + } // Lists built-in native business blueprints available to every authorized tenant. rpc ListBusinessBlueprints(console.v1.ListBusinessBlueprintsRequest) returns (console.v1.ListBusinessBlueprintsResponse) { option (common.v1.required_scopes) = "console:read";