m2 (AI Agent)
8757c6b620
Rail-independence is the plan's spine: fedlearn rails verified NOT landed (no m2/m2-core, no capture/curator CLIs), so the wedge builds against frozen interfaces — m2/market-registry as registry of record, ApplyAdapter seam with local adapter now / m2core-sync stub, schemas frozen here with a fedlearn coordination note. Constitution check passed (1 justified deviation). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
45 lines
2.2 KiB
Markdown
45 lines
2.2 KiB
Markdown
# Contract: m2/market-registry repo layout + PR/veto protocol (v1, frozen)
|
|
|
|
Registry of record on Forgejo (`git.machinemachine.ai/m2/market-registry`). Truth for
|
|
listings and audit; everything downstream (catalog, store, CLI) is derived and rebuildable.
|
|
|
|
## Layout
|
|
|
|
```
|
|
listings/<listing_id>/
|
|
├── listing.json # conforms to schemas/listing.schema.json
|
|
├── solution.json # conforms to schemas/solution.schema.json (current version)
|
|
└── evidence/ # provenance files referenced by solution.evidence[]
|
|
audit/
|
|
└── YYYY-MM-DD.json # daily ledger balance snapshots (ledger-api /snapshot)
|
|
schemas/ -> mirrored copy of frozen v1 schemas (CI validates listings against them)
|
|
```
|
|
|
|
Solution bundles (tarballs: `solution.json` + `payload/` + `recipe.yaml`) attach as
|
|
**repo releases** tagged `<listing_id>-v<semver>`; `listing.json.install_ref` names the tag.
|
|
|
|
## Publish protocol (Story 2)
|
|
|
|
1. Builder branch `listing/<listing_id>` adds/updates `listings/<listing_id>/`.
|
|
2. PR opened with template: evidence summary, price, permissions diff, rollback note.
|
|
Status: `in_review`.
|
|
3. CI validation on PR (schema-validate, evidence non-empty, tenant-firewall rules,
|
|
content_hash matches release asset) — hard-fails before human review (FR-015, spec
|
|
Story 2 AC-2).
|
|
4. Human review window; label `veto` → close (back to draft). Label `approved` + merge →
|
|
`published`. (Same veto semantics the fedlearn pipeline uses; when fedlearn's curation
|
|
`commercialize` disposition lands, it opens THIS PR shape — that is the integration seam.)
|
|
5. Merge webhook (or indexer poll) triggers catalog index (contracts/catalog-index.md).
|
|
|
|
## Delist protocol
|
|
|
|
Commit setting `listing.json.status = "delisted"` (PR, lighter review). Licenses and
|
|
installed bundles remain valid; catalog entry removed on next index; release assets kept.
|
|
|
|
## Rules
|
|
|
|
- No secrets anywhere in the repo (constitution VI); evidence is scrubbed before commit.
|
|
- Registry wins over index on divergence; `m2-market-indexer reindex` rebuilds the
|
|
partition from `main` (constitution II).
|
|
- Tenant-derived listings require `owner_initiated` + double-scrub attestations in the PR
|
|
body; CI rejects `tenant_scope` violations mechanically.
|