schema_version: 1
service_id:
purpose:
owner:
tier:

users_and_groups:
  permitted: []
  explicitly_denied: []

exposure:
  class: null # allowed: lan-vpn, vpn-only, independent-recovery, intentional-public, mixed-public-exception
  user_paths: []
  public_metadata: []

authentication:
  method: null # allowed: application-local, oidc-native, proxy, protocol-specific, none
  local_break_glass:
  mfa:
  session_recovery_test:

admin_path:
  endpoint:
  permitted_source_networks: []
  principals: []
  separable_from_user_path: unverified
  separation_evidence:
  exception_if_not_separable:
    owner_decision_reference:
    reason:
    compensating_controls: []
  outside_denial_test:

life_safety_and_manual_control:
  relevance: unknown
  independent_protection:
  manual_override:
  fail_safe_state:
  agent_actuation: denied
  attended_failure_test:

dependencies:
  hard: []
  soft: []
  readiness_evidence: []

ports_and_protocols:
  - listener:
    protocol:
    source_networks: []
    consumers: []
    reason:

egress:
  internet: null # allowed: none, constrained, required
  local_destinations: []
  dns_policy:
  denial_tests: []

service_identity:
  runtime_principal:
  uid:
  gid:
  supplementary_groups: []
  api_scopes: []

persistent_state:
  paths_or_volumes: []
  data_class:
  filesystem_requirements: []

bulk_data:
  mounts: []
  access: null # allowed: none, read-only, constrained-writer

scratch:
  path_or_tmpfs:
  size_ceiling:
  deletion_rule:

secrets:
  references: []
  issuer:
  consumer:
  rotation:
  revocation:

backup:
  method:
  consistency_method:
  rpo:
  rto:
  retention_owner:
  persistent_path_classification_reference:
  policy_protected_path_references: []
  intentional_omissions:
    - path_reference:
      class: null # allowed: cache, scratch, stateless, replaceable
      reason:
  scheduled_job_id:
  backup_matrix_row_reference:
  source_selection_evidence_reference:
  latest_backup_job_evidence_reference:
  latest_restore_test_evidence_reference:
  result: not-yet-proved # allowed: not-yet-proved, passed, failed, not-applicable

upgrade:
  source:
  version_policy:
  digest_policy:
  migration_behavior:
  discovery_separate_from_installation: true
  update_class: null # allowed: urgent-security, routine-patch, feature-minor, major-platform, firmware
  representative_test_environment: none # allowed: none, disposable, lower-tier, equivalent
  no_staging_recovery_basis:
  prior_version_and_artifact:
  recovery_point:
  prepared_rollback_or_restore:
  rollback_risks: []
  owner_rollback_choice_required: true
  native_post_update_tests: []
  consumer_post_update_tests: []
  denial_post_update_tests: []

health:
  startup:
  readiness:
  independent_user_transaction:
  observation_window:

resources:
  cpu_normal_peak:
  memory_normal_peak:
  io_normal_peak:
  network_normal_peak:
  gpu:
  limits:
  lower_tier_protection_test:

execution_boundary:
  agent_unprivileged_steps: []
  execution_artifact:
    absolute_path:
    format_or_language:
    sha256:
    exact_one_line_invocation:
    host_account_shell_working_directory:
    package_binary_script_config_closure: []
    sealed_paths_and_digests: []
    preflight_assertions: []
    bash_python_checks: []
    regex_fixtures: []
    native_pre_and_post_validators: []
    live_postconditions: []
    consumer_and_denial_tests: []
    evidence_capture:
    success_marker:
    success_only_after_all_checks: true
    failure_exits_nonzero_without_followup_cleanup: true
  independently_reviewed_fixed_actions: []
  stop_conditions: []
  human_authorization_reference:

acceptance_tests:
  executed_inside_artifact: true
  client: []
  restart: []
  dependency_failure: []
  authorization_denials: []
  egress_denials: []
  recovery: []

alerts:
  actionable_failures: []
  parent_inhibition:

retirement:
  export:
  data_disposition:
  listener_removal:
  secret_revocation:
  identity_removal:
  acceptance_test:
