chore: sync api from Mono

.repository-projection.json

@@ -3,11 +3,11 @@
   "projection": "api",
   "projectionSchemaVersion": 1,
   "sourceRepository": "dx-corp/mono",
-  "sourceSha": "2102d45bdf4cf6222425e5b03441015fa8b56026",
+  "sourceSha": "0135ea0655c81b1b2a8e7fb5e4fb00d827607b35",
   "destinationRepository": "dx-corp/api",
-  "priorProjectedBase": "c5a0cb3eba3ee7d6f925cc427731059da8baaf9d",
+  "priorProjectedBase": "c4d7654c2c9fe69d1da9ea22080477b295672aef",
   "definitionDigest": "144b18a5c1f3e7ee6e2d1abc32f80a97adfeacd088911ec659d63622fe85d18c",
   "toolDigest": "f58d71f023a4f0a27d77cb96dcc5348a40816d0b",
-  "contentDigest": "9c511d26160cf43067b82f99f3074eaf99f44b8b9dfe72f0d89f3e221a24984a",
+  "contentDigest": "ecd825d20fda2280d75beeb94a05a0dde6db315da21a4958e4024159b7824a8f",
   "publicationEligible": true
 }

openapi/console/v1/console.openapi.yaml

@@ -2,6 +2,42 @@ openapi: 3.1.0
 info:
   title: console.v1
 paths:
+  /console.v1.ConsoleService/AssessComplianceSubject:
+    post:
+      tags:
+        - console.v1.ConsoleService
+      summary: AssessComplianceSubject
+      description: Evaluates a versioned compliance profile against owner-fetched, tenant-scoped facts.
+      operationId: console.v1.ConsoleService.AssessComplianceSubject
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.AssessComplianceSubjectRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.AssessComplianceSubjectResponse'
   /console.v1.ConsoleService/ListBusinessBlueprints:
     post:
       tags:
@@ -9315,6 +9351,15 @@ components:
          this workspace. NOT_CONFIGURED means the deployment has no commitment-ledger
          origin configured, so the response carries no commitments instead of an
          empty ledger that would read as "you have none".
+    console.v1.ComplianceFindingStatus:
+      type: string
+      title: ComplianceFindingStatus
+      enum:
+        - COMPLIANCE_FINDING_STATUS_UNSPECIFIED
+        - COMPLIANCE_FINDING_STATUS_SATISFIED
+        - COMPLIANCE_FINDING_STATUS_VIOLATED
+        - COMPLIANCE_FINDING_STATUS_INDETERMINATE
+        - COMPLIANCE_FINDING_STATUS_NOT_APPLICABLE
     console.v1.ComputerMissionAuthorityMode:
       type: string
       title: ComputerMissionAuthorityMode
@@ -11352,6 +11397,35 @@ components:
       required:
         - settings
       additionalProperties: false
+    console.v1.AssessComplianceSubjectRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+        workspaceId:
+          type: string
+          title: workspace_id
+        profileId:
+          type: string
+          title: profile_id
+        subjectKind:
+          type: string
+          title: subject_kind
+        subjectId:
+          type: string
+          title: subject_id
+      title: AssessComplianceSubjectRequest
+      additionalProperties: false
+      description: One versioned control profile runs against one owner-fetched subject.
+    console.v1.AssessComplianceSubjectResponse:
+      type: object
+      properties:
+        assessment:
+          title: assessment
+          $ref: '#/components/schemas/console.v1.ComplianceSubjectAssessment'
+      title: AssessComplianceSubjectResponse
+      additionalProperties: false
     console.v1.AttachPrivateEndpointToProfileRequest:
       type: object
       properties:
@@ -14444,6 +14518,65 @@ components:
       required:
         - upload
       additionalProperties: false
+    console.v1.ComplianceRequirementFinding:
+      type: object
+      properties:
+        requirementId:
+          type: string
+          title: requirement_id
+        status:
+          title: status
+          $ref: '#/components/schemas/console.v1.ComplianceFindingStatus'
+        reasonCode:
+          type: string
+          title: reason_code
+        sourceRef:
+          type: string
+          title: source_ref
+      title: ComplianceRequirementFinding
+      additionalProperties: false
+    console.v1.ComplianceSubjectAssessment:
+      type: object
+      properties:
+        profileId:
+          type: string
+          title: profile_id
+        subjectKind:
+          type: string
+          title: subject_kind
+        subjectId:
+          type: string
+          title: subject_id
+        sourceDigest:
+          type: string
+          title: source_digest
+        sourceUpdatedAt:
+          title: source_updated_at
+          $ref: '#/components/schemas/google.protobuf.Timestamp'
+        assessedAt:
+          title: assessed_at
+          $ref: '#/components/schemas/google.protobuf.Timestamp'
+        status:
+          title: status
+          $ref: '#/components/schemas/console.v1.ComplianceFindingStatus'
+        findings:
+          type: array
+          items:
+            $ref: '#/components/schemas/console.v1.ComplianceRequirementFinding'
+          title: findings
+        inspectedCount:
+          type: integer
+          title: inspected_count
+          description: This route covers exactly the one requested owner record.
+        expectedCount:
+          type: integer
+          title: expected_count
+        controlId:
+          type: string
+          title: control_id
+      title: ComplianceSubjectAssessment
+      additionalProperties: false
+      description: A live, bounded assessment of one execution. It is not an immutable snapshot.
     console.v1.ComputerMission:
       type: object
       properties:

openapi/deixic/v1/deixic.openapi.yaml

@@ -2,6 +2,42 @@ openapi: 3.1.0
 info:
   title: deixic.v1
 paths:
+  /deixic.v1.DeixicService/AssessComplianceSubject:
+    post:
+      tags:
+        - deixic.v1.DeixicService
+      summary: AssessComplianceSubject
+      description: Evaluates a versioned compliance profile against owner-fetched, tenant-scoped facts.
+      operationId: deixic.v1.DeixicService.AssessComplianceSubject
+      parameters:
+        - name: Connect-Protocol-Version
+          in: header
+          required: true
+          schema:
+            $ref: '#/components/schemas/connect-protocol-version'
+        - name: Connect-Timeout-Ms
+          in: header
+          schema:
+            $ref: '#/components/schemas/connect-timeout-header'
+      requestBody:
+        content:
+          application/json:
+            schema:
+              $ref: '#/components/schemas/console.v1.AssessComplianceSubjectRequest'
+        required: true
+      responses:
+        default:
+          description: Error
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/connect.error'
+        "200":
+          description: Success
+          content:
+            application/json:
+              schema:
+                $ref: '#/components/schemas/console.v1.AssessComplianceSubjectResponse'
   /deixic.v1.DeixicService/ListBusinessBlueprints:
     post:
       tags:
@@ -8838,6 +8874,15 @@ components:
          this workspace. NOT_CONFIGURED means the deployment has no commitment-ledger
          origin configured, so the response carries no commitments instead of an
          empty ledger that would read as "you have none".
+    console.v1.ComplianceFindingStatus:
+      type: string
+      title: ComplianceFindingStatus
+      enum:
+        - COMPLIANCE_FINDING_STATUS_UNSPECIFIED
+        - COMPLIANCE_FINDING_STATUS_SATISFIED
+        - COMPLIANCE_FINDING_STATUS_VIOLATED
+        - COMPLIANCE_FINDING_STATUS_INDETERMINATE
+        - COMPLIANCE_FINDING_STATUS_NOT_APPLICABLE
     console.v1.ComputerMissionAuthorityMode:
       type: string
       title: ComputerMissionAuthorityMode
@@ -10741,6 +10786,35 @@ components:
       required:
         - settings
       additionalProperties: false
+    console.v1.AssessComplianceSubjectRequest:
+      type: object
+      properties:
+        organizationId:
+          type: string
+          title: organization_id
+        workspaceId:
+          type: string
+          title: workspace_id
+        profileId:
+          type: string
+          title: profile_id
+        subjectKind:
+          type: string
+          title: subject_kind
+        subjectId:
+          type: string
+          title: subject_id
+      title: AssessComplianceSubjectRequest
+      additionalProperties: false
+      description: One versioned control profile runs against one owner-fetched subject.
+    console.v1.AssessComplianceSubjectResponse:
+      type: object
+      properties:
+        assessment:
+          title: assessment
+          $ref: '#/components/schemas/console.v1.ComplianceSubjectAssessment'
+      title: AssessComplianceSubjectResponse
+      additionalProperties: false
     console.v1.AttachPrivateEndpointToProfileRequest:
       type: object
       properties:
@@ -13833,6 +13907,65 @@ components:
       required:
         - upload
       additionalProperties: false
+    console.v1.ComplianceRequirementFinding:
+      type: object
+      properties:
+        requirementId:
+          type: string
+          title: requirement_id
+        status:
+          title: status
+          $ref: '#/components/schemas/console.v1.ComplianceFindingStatus'
+        reasonCode:
+          type: string
+          title: reason_code
+        sourceRef:
+          type: string
+          title: source_ref
+      title: ComplianceRequirementFinding
+      additionalProperties: false
+    console.v1.ComplianceSubjectAssessment:
+      type: object
+      properties:
+        profileId:
+          type: string
+          title: profile_id
+        subjectKind:
+          type: string
+          title: subject_kind
+        subjectId:
+          type: string
+          title: subject_id
+        sourceDigest:
+          type: string
+          title: source_digest
+        sourceUpdatedAt:
+          title: source_updated_at
+          $ref: '#/components/schemas/google.protobuf.Timestamp'
+        assessedAt:
+          title: assessed_at
+          $ref: '#/components/schemas/google.protobuf.Timestamp'
+        status:
+          title: status
+          $ref: '#/components/schemas/console.v1.ComplianceFindingStatus'
+        findings:
+          type: array
+          items:
+            $ref: '#/components/schemas/console.v1.ComplianceRequirementFinding'
+          title: findings
+        inspectedCount:
+          type: integer
+          title: inspected_count
+          description: This route covers exactly the one requested owner record.
+        expectedCount:
+          type: integer
+          title: expected_count
+        controlId:
+          type: string
+          title: control_id
+      title: ComplianceSubjectAssessment
+      additionalProperties: false
+      description: A live, bounded assessment of one execution. It is not an immutable snapshot.
     console.v1.ComputerMission:
       type: object
       properties:

proto/console/v1/console.proto

@@ -26,6 +26,13 @@ option go_package = "github.com/evalops/platform/gen/go/console/v1;consolev1";
 // governance, usage, integrations, and posture without exposing protocol
 // details such as MCP as the primary product contract.
 service ConsoleService {
+  // Evaluates a versioned compliance profile against owner-fetched, tenant-scoped facts.
+  rpc AssessComplianceSubject(AssessComplianceSubjectRequest) returns (AssessComplianceSubjectResponse) {
+    option (common.v1.required_scopes) = "console:read";
+    option (common.v1.organization_scope_field) = "organization_id";
+    option (common.v1.workspace_scope_field) = "workspace_id";
+    option (common.v1.risk_level) = RISK_LEVEL_LOW;
+  }
   // Lists built-in native business blueprints available to every authorized tenant.
   rpc ListBusinessBlueprints(ListBusinessBlueprintsRequest) returns (ListBusinessBlueprintsResponse) {
     option (common.v1.required_scopes) = "console:read";
@@ -11029,3 +11036,47 @@ message StaffProductIssueRecoverySummary {
   google.protobuf.Timestamp created_at = 8;
   string last_reply = 9 [(common.v1.classification) = DATA_CLASSIFICATION_CONTENT];
 }
+
+// One versioned control profile runs against one owner-fetched subject.
+message AssessComplianceSubjectRequest {
+  string organization_id = 1 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+  string workspace_id = 2 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+  string profile_id = 3 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+  string subject_kind = 4 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+  string subject_id = 5 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+}
+
+enum ComplianceFindingStatus {
+  COMPLIANCE_FINDING_STATUS_UNSPECIFIED = 0;
+  COMPLIANCE_FINDING_STATUS_SATISFIED = 1;
+  COMPLIANCE_FINDING_STATUS_VIOLATED = 2;
+  COMPLIANCE_FINDING_STATUS_INDETERMINATE = 3;
+  COMPLIANCE_FINDING_STATUS_NOT_APPLICABLE = 4;
+}
+
+message ComplianceRequirementFinding {
+  string requirement_id = 1 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+  ComplianceFindingStatus status = 2;
+  string reason_code = 3 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+  string source_ref = 4 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+}
+
+// A live, bounded assessment of one execution. It is not an immutable snapshot.
+message ComplianceSubjectAssessment {
+  string profile_id = 1 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+  string subject_kind = 2 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+  string subject_id = 3 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+  string source_digest = 4 [(common.v1.classification) = DATA_CLASSIFICATION_IDENTIFIER];
+  google.protobuf.Timestamp source_updated_at = 5;
+  google.protobuf.Timestamp assessed_at = 6;
+  ComplianceFindingStatus status = 7;
+  repeated ComplianceRequirementFinding findings = 8;
+  // This route covers exactly the one requested owner record.
+  uint32 inspected_count = 9;
+  uint32 expected_count = 10;
+  string control_id = 11 [(common.v1.classification) = DATA_CLASSIFICATION_SAFE];
+}
+
+message AssessComplianceSubjectResponse {
+  ComplianceSubjectAssessment assessment = 1;
+}