schema_version: 1
observed_at:
owner:

# Replace these illustrative ranges only after a collision scan. UID and GID
# namespaces are checked separately. Child directory slices intentionally sit
# inside directory_primary; every unrelated range must be disjoint.
numeric_namespace:
  directory_primary: {start: 200000, end: 399999, future_authority: freeipa}
  directory_automatic_headroom: {start: 200000, end: 299999, parent: directory_primary}
  directory_people: {start: 300000, end: 309999, parent: directory_primary}
  directory_shared_groups: {start: 310000, end: 319999, parent: directory_primary}
  directory_future: {start: 320000, end: 399999, parent: directory_primary}
  local_services: {start: 400000, end: 419999, authority: local-declared}
  local_agents: {start: 420000, end: 420999, authority: local-declared}

subordinate_ids:
  - host:
    principal:
    subuid_start:
    subuid_count:
    subgid_start:
    subgid_count:
    consumer: null # allowed: rootless-container-runtime, user-namespace, other

collision_scan:
  sources:
    - /etc/passwd on every participating host
    - /etc/group on every participating host
    - /etc/subuid and /etc/subgid
    - NAS and restored-data ownership samples
    - container and directory-service ranges
  uid_collisions: []
  gid_collisions: []
  subordinate_id_collisions: []
  evidence_reference:
  result: unverified

directory_migration:
  target: undecided # allowed: freeipa, none, undecided
  installed_primary_range:
  preallocated_principals_imported: []
  test_host:
  local_shadowing_checked: false
  ownership_samples_before:
  ownership_samples_after:
  rollback:

validators:
  - exact ranges match the accepted decision
  - unrelated UID ranges do not overlap
  - unrelated GID ranges do not overlap
  - subordinate ranges do not overlap any host allocation
  - getent and id return registered values on every participating host
  - representative restored files retain intended numeric ownership
