Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 8 additions & 8 deletions .github/workflows/ci.yaml
Original file line number Diff line number Diff line change
Expand Up @@ -10,37 +10,37 @@ jobs:
ci:
runs-on: ubuntu-latest
steps:
- name: Checkout seam-core
- name: Checkout seam
uses: actions/checkout@v4
with:
path: seam-core
path: seam

- name: Set up Go
uses: actions/setup-go@v5
with:
go-version-file: seam-core/go.mod
go-version-file: seam/go.mod
cache: true

- name: Build
working-directory: seam-core
working-directory: seam
run: make build

- name: Lint
working-directory: seam-core
working-directory: seam
run: |
go install github.com/golangci/golangci-lint/cmd/golangci-lint@latest
golangci-lint run --timeout 5m ./...

- name: Unit tests
working-directory: seam-core
working-directory: seam
run: make test-unit

- name: Integration tests
working-directory: seam-core
working-directory: seam
run: make test-integration

- name: e2e tests
working-directory: seam-core
working-directory: seam
run: |
E2E_OUT=$(go test ./test/e2e/... -v 2>&1 || true)
SKIPPED=$(echo "$E2E_OUT" | grep -c '\[SKIPPED\]\|S\[' || echo 0)
Expand Down
32 changes: 23 additions & 9 deletions CLAUDE.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,29 @@
## seam-core: Operational Constraints
> Read ~/ontai/CLAUDE.md first. The constraints below extend the root constitutional document.
## seam: Operational Constraints

Read `~/ontai/CLAUDE.md` first. The constraints below extend the root constitutional document.

---

### Schema authority
Primary: docs/seam-core-schema.md
Supporting: ~/ontai/domain-core/docs/domain-core-schema.md (DomainLineageIndex schema owner)

Primary reference: `docs/seam-schema.md`

`docs/seam-schema.md` is the authoritative field-level specification for every CRD type declared in this repository and for the shared library packages in `pkg/`. Read it in full before any CRD change or shared library change. Source files are the ground truth for field shapes; the schema doc reflects them and must be kept in sync.

---

### Invariants
SC-INV-001 -- seam-core owns all cross-operator CRD definitions under infrastructure.ontai.dev. The complete set of seam-core-owned types is: InfrastructureLineageIndex, InfrastructureRunnerConfig, InfrastructurePackReceipt, InfrastructureClusterPack, InfrastructurePackExecution, InfrastructurePackInstance, InfrastructurePackBuild, InfrastructureTalosCluster, DriftSignal, InfrastructurePolicy, InfrastructureProfile. Reconcilers for these CRDs live in the operator repos that own the domain logic, not in seam-core.
SC-INV-002 -- RunnerConfig and all cross-operator CRD type migrations to seam-core are complete as of Phase 2B (2026-04-25). No further governed migration sessions are required. The old API groups runner.ontai.dev and infra.ontai.dev are superseded. All new CRD work goes directly into seam-core under infrastructure.ontai.dev.
SC-INV-003 -- seam-core CRD manifests are installed before all operators. No operator reaches Running state on a cluster that has not applied the seam-core CRD bundle first.

SC-INV-001 -- seam owns all cross-operator CRD definitions under seam.ontai.dev. The complete set of seam-owned types is: LineageRecord, RunnerConfig, DriftSignal, SeamMembership. Reconcilers for these CRDs live in the operator repos that own the domain logic, not in seam.

SC-INV-002 -- All new CRD work goes directly into seam under seam.ontai.dev. No new type is declared outside this repository without an explicit Governor directive.

SC-INV-003 -- seam CRD manifests are installed before all operators. No operator reaches Running state on a cluster that has not applied the seam CRD bundle first.

---

### Session protocol additions
Step 4a -- Read docs/seam-core-schema.md in full before any CRD or shared library change.
Step 4b -- Any change to the creation rationale vocabulary (the Go constant enumeration owned by seam-core) requires a PR and Platform Governor review. No operator may extend the enumeration unilaterally. (root Section 14 Decision 5)

Step 4a -- Read `docs/seam-schema.md` in full before any CRD or shared library change.

Step 4b -- Any change to the `CreationRationale` vocabulary (the Go constant enumeration in `pkg/lineage/rationale.go`) requires a PR and Platform Governor review. No operator may extend the enumeration unilaterally. (root Section 14 Decision 5)
130 changes: 39 additions & 91 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,134 +1,82 @@
# seam-core
# seam

**Seam Core - Cross-operator CRD definitions and shared library**
**API Group:** `infrastructure.ontai.dev`
API group: `seam.ontai.dev`

---

## What this repository is

`seam-core` declares the cross-operator CRD types shared across the Seam platform
and owns the shared library packages imported by all operators and both Compiler
and Conductor binaries.

No operator or binary in the Seam stack is deployed from this repository.
`seam-core` is a schema controller and library repository.
seam owns the cross-operator CRD type definitions and shared library packages for the ONT platform. No operator binary is deployed from this repository. seam installs its CRD manifests before all operators reach Running state on any cluster (SC-INV-003).

---

## CRDs
## CRD types

| Kind | API Group | Role |
|---|---|---|
| `InfrastructureLineageIndex` | `infrastructure.ontai.dev` | Sealed causal chain index for infrastructure declarations |
| `SeamMembership` | `infrastructure.ontai.dev` | Domain membership record linking a principal to a target cluster |
All four types are under `seam.ontai.dev/v1alpha1`.

---

## Shared packages
| Kind | Short name | Scope | Authoring principal |
|---|---|---|---|
| LineageRecord | lr | Namespaced | LineageController (controller-authored exclusively) |
| RunnerConfig | rc | Namespaced | platform operator (operator-generated, never human-authored) |
| DriftSignal | ds | Namespaced | conductor role=tenant |
| SeamMembership | sm | Namespaced | human / GitOps |

| Package | Role |
|---|---|
| `pkg/lineage` | `CreationRationale` enumeration and lineage record construction helpers |
| `pkg/conditions` | Shared condition type constants used across all Seam CRDs |
| `pkg/e2e` | End-to-end test helpers (not imported in production code) |
Schema reference: [docs/seam-schema.md](docs/seam-schema.md)

---

## InfrastructureLineageIndex
## Shared packages

`InfrastructureLineageIndex` is the concrete instantiation of the
`DomainLineageIndex` abstract pattern from `domain-core`. One instance is created
per root declaration, never one per derived object. This is the **Lineage Index
Pattern**.
### `pkg/lineage`

Key properties:
- `spec.rootBinding` is immutable after creation. The admission webhook rejects any
UPDATE that modifies this section.
- `spec.descendantRegistry` is monotonically growing. Entries are appended, never
modified or removed.
- Controller-authored exclusively. Writes from any principal other than the
designated controller service account are rejected at admission.
Defines the `SealedCausalChain` type embedded in every Seam-managed CRD spec. Defines `CreationRationale`, the compile-time controlled vocabulary for why a derived object was created. Provides `SetDescendantLabels` for operators to mark derived objects at creation time. No operator extends this vocabulary unilaterally -- new values require a seam PR and Platform Governor review.

---
Import path: `github.com/ontai-dev/seam/pkg/lineage`

## SeamMembership
### `pkg/conditions`

`SeamMembership` records that a principal (identified by a Kubernetes service account
reference) has been admitted to a target cluster domain. The reconciler in `guardian`
owns this record.
Defines condition type and reason string constants for all ONT operators. This package is the single source of truth for every condition type and reason used across guardian, platform, dispatcher, and conductor. Operators import these constants rather than declaring their own strings.

Admission requires:
1. The referenced `RBACProfile` exists and has `provisioned=true`.
2. The `domainIdentityRef` in the `RBACProfile` matches the `principalRef`.
Import path: `github.com/ontai-dev/seam/pkg/conditions`

---

## CreationRationale vocabulary

The `pkg/lineage` package exports the `CreationRationale` enumeration. This is the
compile-time controlled vocabulary for why a root declaration was created. All
operators and both binaries import this enumeration. New values require a Pull
Request to this repository and a Platform Governor review.
## Building

Current values:
- `ClusterProvision`
- `ClusterDecommission`
- `SecurityEnforcement`
- `PackExecution`
- `VirtualizationFulfillment`
- `ConductorAssignment`
- `VortexBinding`
Compile all packages:

---
```
make build
```

## Building
Generate deep-copy methods and CRD manifests:

```sh
go build ./...
```
make generate
```

There is no deployable binary in this repository. The build target confirms that
all packages compile cleanly.
Requires `controller-gen` on PATH or at `~/go/bin/controller-gen`.

---

## Testing

```sh
go test ./...
```
Unit tests:

---
```
make test-unit
```

## Schema reference
End-to-end tests require `MGMT_KUBECONFIG` to be set. All e2e specs skip automatically when the variable is absent:

- `docs/seam-core-schema.md` - Full API contract and field definitions
```
make e2e
```

---

## Status

Alpha. Deployed and tested on management cluster (ccs-mgmt).
Tenant cluster onboarding is not yet verified end to end.
See [docs/seam-core-schema.md](./docs/seam-core-schema.md)
for current capability and known gaps.

CRDs are deployed and reconciling on the live management cluster.
The schema specification is published at:
https://schema.ontai.dev/v1alpha1/

## Contributing

Read [CONTRIBUTING.md](./CONTRIBUTING.md) before opening a pull
request. Every new reconciliation behavior requires a written
specification and senior engineer sign-off before any code is
written.
Alpha. API group `seam.ontai.dev/v1alpha1`. No type in this group has graduated to beta.

File issues at https://github.com/ontai-dev/seam-core/issues.
For security issues contact security@ontai.dev directly.
Issues: https://github.com/ontai-dev/seam/issues

---

*seam-core - Seam Core Schema Controller and Shared Library*
*Apache License, Version 2.0*
seam - Seam Cross-Operator CRD Definitions and Shared Library / Apache License, Version 2.0
Loading
Loading