Agent task: define SourceOS control-plane object schemas for lifecycle proof

[mdheller]

Agent-directed work package.

Target agent: Codex environment for SourceOS-Linux/sourceos-spec; Copilot coding agent if available.

Context:
sourceos-spec should become the canonical SourceOS standards home for the lifecycle/control-plane objects needed by the M2 demo and future mesh/fleet rollout.

Scope:

1. Inspect the live repository before editing.
2. Add docs/CONTROL_PLANE_OBJECT_MODEL.md defining: ExperienceProfile, PolicyBundle, ReleaseSet, BootReleaseSet, Fingerprint, AuditLog/ProofBundle, ConfigSource, TokenDoor, DevtoolsProfile, SourceOSDesiredState, PAL, and HISC.
3. Add JSON schemas for the highest-priority objects: release-set.v1, boot-release-set.v1, fingerprint.v1, experience-profile.v1, policy-bundle.v1, config-source.v1, and token-door.v1.
4. Add example fixtures for an M2 GNOME mac-like ReleaseSet and SourceOS Recovery BootReleaseSet.
5. Add Makefile validation target.
6. Add repo.maturity.yaml using the repo-maturity.v1 semantics from SocioProphet/functional-model-surfaces.

Acceptance criteria:

• make validate passes.
• Schemas are compact and coherent; no secrets, tokens, or binaries are committed.
• Docs clearly separate portable core from platform adaptation layer.
• BootReleaseSet maps cleanly to nlboot/SourceOS boot and Apple Silicon recovery-style UX.

Boundary:
One PR only. Do not implement the boot client or installer here; this repo defines the normative contracts.

[mdheller]

@codex Please take this issue in the sourceos-spec Codex environment. Inspect the repo, add the bounded SourceOS object-model schemas/docs described in the issue, open one PR, and include make validate evidence.

[mdheller]

@copilot Please take this issue if Copilot coding agent is available. Keep the repo as standards/contracts only, open one PR, and include make validate evidence.

[chatgpt-codex-connector]

Summary

• Added a new bounded control-plane model doc at docs/CONTROL_PLANE_OBJECT_MODEL.md covering all requested objects (ExperienceProfile, PolicyBundle, ReleaseSet, BootReleaseSet, Fingerprint, AuditLog/ProofBundle, ConfigSource, TokenDoor, DevtoolsProfile, SourceOSDesiredState) and explicitly separating portable core vs PAL, plus HISC and boot mapping notes for SourceOS/nlboot and Apple Silicon recovery-style UX. docs/CONTROL_PLANE_OBJECT_MODEL.mdL1-L51
• Added the requested compact v1 schemas:
  • release-set.v1
  • boot-release-set.v1
  • fingerprint.v1
  • experience-profile.v1
  • policy-bundle.v1
  • config-source.v1
  • token-door.v1. schemas/control-plane/release-set.v1.schema.jsonL1-L18 schemas/control-plane/boot-release-set.v1.schema.jsonL1-L30 schemas/control-plane/fingerprint.v1.schema.jsonL1-L16 schemas/control-plane/experience-profile.v1.schema.jsonL1-L15 schemas/control-plane/policy-bundle.v1.schema.jsonL1-L14 schemas/control-plane/config-source.v1.schema.jsonL1-L15 schemas/control-plane/token-door.v1.schema.jsonL1-L14
• Added both requested fixtures:
  • M2 GNOME mac-like ReleaseSet
  • SourceOS recovery BootReleaseSet with SourceOS + Apple Silicon entrypoints. examples/control-plane/release-set.m2-gnome-maclike.sample.jsonL1-L13 examples/control-plane/boot-release-set.sourceos-recovery.sample.jsonL1-L24
• Added repo.maturity.yaml with repo-maturity.v1 semantics and a make validate quality gate. repo.maturity.yamlL1-L15
• Updated validation flow so make validate runs local example/schema checks via tools/validate_control_plane_examples.py and no longer depends on runtime package installation. MakefileL1-L7 tools/validate_control_plane_examples.pyL1-L49

Testing

• ✅ make validate
• ✅ git status --short (verified clean working tree after commit)
• ✅ git commit -m "Add bounded SourceOS control-plane object model and v1 schemas" (commit a5c1af1)

Also completed: created a PR record via make_pr with title “Add bounded SourceOS control-plane object model, v1 schemas, and validation evidence” and included make validate evidence in the body.

View task →