{ "components": { "parameters": { "ActionID": { "in": "path", "name": "actionID", "required": true, "schema": { "$ref": "#/components/schemas/ActionID" } }, "ActionSignature": { "description": "65-byte hex EIP-191 personal signature of the server-bound action digest. Missing, invalid, or non-owner signatures on owner-authenticated execute and read routes return the same 404 response as an unknown resource.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "pattern": "^(0x)?[0-9a-fA-F]{130}$", "type": "string" } }, "ConfigAddress": { "description": "Exactly one public EVM address matching the recovered signer (case-insensitive). This is an authentication hint, not an owner override; owner_id is derived from authenticated identity.", "in": "header", "name": "CYNDER-CONFIG-ADDRESS", "required": true, "schema": { "pattern": "^(0[xX])?[0-9a-fA-F]{40}$", "type": "string" } }, "ConfigID": { "in": "path", "name": "configID", "required": true, "schema": { "$ref": "#/components/schemas/ConfigID" } }, "ConfigIdempotencyKey": { "description": "Exactly one nonempty UTF-8 value, at most 128 bytes, with no surrounding whitespace, Unicode controls or replacement characters. Shared across all config mutations for this signer. No key is sent on GET.", "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 128, "minLength": 1, "type": "string" } }, "ConfigSignature": { "description": "Exactly one EIP-191 signature over the decoded 32-byte config signing digest described at /v1/configs. Invalid or missing authentication returns 401 without a digest challenge, unlike paid action preparation.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "pattern": "^(0x)?[0-9a-fA-F]{130}$", "type": "string" } }, "DeploymentID": { "in": "path", "name": "deploymentID", "required": true, "schema": { "$ref": "#/components/schemas/DeploymentID" } }, "IdempotencyKey": { "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "maxLength": 255, "minLength": 1, "type": "string" } }, "OptionalActionSignature": { "description": "65-byte hex EIP-191 personal signature of the server-bound action digest. Omit from a prepare request once to receive the digest challenge in CYNDER-ACTION-DIGEST.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": false, "schema": { "pattern": "^(0x)?[0-9a-fA-F]{130}$", "type": "string" } }, "PaymentSignature": { "description": "Base64 x402 v2 payment payload. Omit once to receive PAYMENT-REQUIRED.", "in": "header", "name": "PAYMENT-SIGNATURE", "required": false, "schema": { "contentEncoding": "base64", "maxLength": 65536, "type": "string" } } }, "responses": { "ConfigAdmission": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "wallet_enrollment_required: active deploy wallet enrollment required. Create and retain (including replays) require ACTIVE enrollment, x402 activation and deploy scope. Owned revoke and reads are exempt." }, "ConfigConflict": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "idempotency_conflict for a key reused with another operation/ID/content; lifecycle_conflict for shortening retention or mutating the system legacy version; config_capacity for exhausted store-wide lifetime capacity (256 versions, 1024 ordinary replay results, plus one reserved active-to-revoked transition per existing version, at most 1280 total results). Exact replay consumes no capacity; new-key no-op revocations cannot use the reserve." }, "ConfigInvalid": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "invalid_config_request: invalid config request (including malformed JSON, limits on decoded data, forbidden body/key/query/path, or invalid timestamp)." }, "ConfigMediaType": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "unsupported_media_type: application/json required for POST." }, "ConfigNotFound": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "not_found: config not found. Identical for cross-owner, invalid and unknown IDs." }, "ConfigStoreError": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "store_error: config store unavailable. Internal integrity/storage details are not exposed." }, "ConfigTooLarge": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "request_too_large: config request too large. Raw body exceeds 524288 bytes." }, "ConfigUnauthorized": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "signature_required: valid domain-bound config signature and address required. No CYNDER-ACTION-DIGEST challenge is returned." }, "ConfigVersion": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConfigVersion" } } }, "description": "Owner-private immutable content and lifecycle snapshot. idempotency_key is the original creation key. Replay returns the original mutation result, without Location or Idempotency-Replayed headers.", "headers": { "Cache-Control": { "schema": { "const": "private, no-store", "type": "string" } }, "Vary": { "schema": { "const": "CYNDER-ACTION-SIGNATURE, CYNDER-CONFIG-ADDRESS", "type": "string" } } } }, "Error": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "Error envelope" }, "RateLimitError": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "Request rejected by an action preparation or execution capacity limit.", "headers": { "Retry-After": { "required": true, "schema": { "minimum": 1, "type": "integer" } } } } }, "schemas": { "Action": { "additionalProperties": false, "description": "Signed-owner allowlist; raw action payload is never returned.", "properties": { "action_id": { "$ref": "#/components/schemas/ActionID" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "digest": { "$ref": "#/components/schemas/Digest" }, "idempotency_key": { "type": "string" }, "owner_id": { "description": "CAIP-2 network plus lower-case EVM payer identity", "type": "string" }, "payload_digest": { "$ref": "#/components/schemas/Digest" }, "type": { "enum": [ "DEPLOY", "DEPLOY_VERSION", "ROLLBACK_VERSION", "ENROLL_WALLET", "INVOKE", "DELETE", "REGISTER_ARTIFACT", "RETAIN_ARTIFACT", "ACQUIRE_LEASE", "RENEW_LEASE", "RESIZE_LEASE" ], "type": "string" } }, "required": [ "action_id", "type", "owner_id", "idempotency_key", "payload_digest", "digest", "created_at" ], "type": "object" }, "ActionID": { "pattern": "^act_[0-9a-f]{32}$", "type": "string" }, "ActionState": { "additionalProperties": false, "properties": { "action_id": { "$ref": "#/components/schemas/ActionID" }, "attempt": { "minimum": 0, "type": "integer" }, "failure_code": { "$ref": "#/components/schemas/PublicFailureCode" }, "original_failure_code": { "$ref": "#/components/schemas/PublicFailureCode" }, "original_failure_receipt_digest": { "$ref": "#/components/schemas/Digest" }, "original_refund": { "$ref": "#/components/schemas/RefundStatus" }, "payment_amount": { "pattern": "^[0-9]+$", "type": "string" }, "payment_asset": { "type": "string" }, "payment_pay_to": { "type": "string" }, "payment_status": { "enum": [ "UNPAID", "SETTLING", "SETTLED", "SETTLEMENT_UNKNOWN" ], "type": "string" }, "receipt_sequence": { "minimum": 0, "type": "integer" }, "refund": { "$ref": "#/components/schemas/RefundStatus" }, "refund_policy_version": { "description": "Immutable server-captured policy; not part of action signing.", "type": "string" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "updated_at": { "$ref": "#/components/schemas/Timestamp" } }, "required": [ "action_id", "status", "attempt", "payment_status", "receipt_sequence", "updated_at" ], "type": "object" }, "ActionStatus": { "description": "WAITING_EFFECTIVE_TIME is nonterminal settled resize scheduling, never activation or success.", "enum": [ "PENDING", "EXECUTING", "WAITING_EFFECTIVE_TIME", "SUCCEEDED", "FAILED", "UNKNOWN" ], "type": "string" }, "ActionView": { "additionalProperties": false, "description": "Output is supplied only on execution. INVOKE returns owner workload JSON on successful execute and authenticated same-action settled replay without a fresh key/payment; GET omits INVOKE output. UNKNOWN requires reconciliation, not payment retry. Other actions return allowlisted identifiers/status. Reads never return legacy raw receipt output or stored tuples.", "properties": { "action": { "$ref": "#/components/schemas/Action" }, "output": { "$ref": "#/components/schemas/JSONValue", "description": "Owner-private execution output. Version activation output is filtered to safe identifiers/status; fresh readiness belongs to committed receipt deployment_evidence, not output. Never publish this field through Explorer." }, "receipts": { "items": { "$ref": "#/components/schemas/Receipt" }, "type": "array" }, "state": { "$ref": "#/components/schemas/ActionState" } }, "required": [ "action", "state", "receipts" ], "type": "object" }, "ArtifactActionRequest": { "allOf": [ { "$ref": "#/components/schemas/CreateActionRequest" }, { "properties": { "type": { "enum": [ "REGISTER_ARTIFACT", "RETAIN_ARTIFACT" ], "type": "string" } }, "type": "object" } ] }, "ArtifactID": { "pattern": "^art_[0-9a-f]{32}$", "type": "string" }, "ConfigEnvironment": { "additionalProperties": { "maxLength": 8192, "type": "string" }, "description": "Non-secret values only; {} is valid. Limits are UTF-8 byte limits, not Unicode character counts: 128 keys, 128 bytes/key, 8192 bytes/value, 65536 total decoded key-plus-value bytes. Reject Unicode control characters (including NUL, newline and tab), U+FFFD, invalid UTF-8, duplicate keys (including escaped equivalents), and non-string or null values. The full HTTP request body is limited to 524288 bytes.", "maxProperties": 128, "propertyNames": { "maxLength": 128, "pattern": "^[A-Za-z_][A-Za-z0-9_]*$", "type": "string" }, "type": "object" }, "ConfigID": { "description": "Opaque random owner version ID; cfg_legacy_empty_v1 is a reserved internal compatibility identity, not an owner record.", "pattern": "^cfg_([0-9a-f]{32}|legacy_empty_v1)$", "type": "string" }, "ConfigList": { "additionalProperties": false, "properties": { "configs": { "items": { "$ref": "#/components/schemas/ConfigVersion" }, "type": "array" } }, "required": [ "configs" ], "type": "object" }, "ConfigVersion": { "additionalProperties": false, "properties": { "created_at": { "$ref": "#/components/schemas/Timestamp" }, "digest": { "description": "SHA-256 of Go encoding/json compact map encoding, ASCII keys sorted lexically, HTML escaping enabled (including \u0026, \u003c, \u003e and U+2028/U+2029), no trailing newline. Only env participates, not owner/ID/lifecycle. Distinct from the raw-body signing digest.", "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "env": { "$ref": "#/components/schemas/ConfigEnvironment" }, "id": { "pattern": "^cfg_[0-9a-f]{32}$", "type": "string" }, "idempotency_key": { "description": "Immutable original creation key, not the most recent lifecycle operation key.", "type": "string" }, "owner_id": { "description": "Private owner identity derived from authenticated signer; never accepted from the request body.", "type": "string" }, "retain_until": { "$ref": "#/components/schemas/Timestamp" }, "revoked_at": { "$ref": "#/components/schemas/Timestamp", "description": "Present only when revoked; not null." }, "state": { "enum": [ "active", "revoked" ], "type": "string" } }, "required": [ "id", "owner_id", "env", "digest", "state", "created_at", "retain_until", "idempotency_key" ], "type": "object" }, "CreateActionRequest": { "additionalProperties": false, "allOf": [ { "if": { "properties": { "type": { "const": "DEPLOY" } } }, "then": { "required": [ "image_digest", "resource_class", "timeout_seconds" ] } }, { "if": { "properties": { "type": { "const": "DEPLOY_VERSION" } } }, "then": { "required": [ "deployment_id", "image_digest", "source_tag", "timeout_seconds" ] } }, { "if": { "properties": { "type": { "const": "ROLLBACK_VERSION" } } }, "then": { "required": [ "deployment_id", "version_id", "timeout_seconds" ] } }, { "if": { "properties": { "type": { "const": "ENROLL_WALLET" } } }, "then": { "required": [ "profile_name", "terms_accepted", "requested_scopes" ] } }, { "if": { "properties": { "type": { "const": "INVOKE" } } }, "then": { "required": [ "deployment_id", "input", "timeout_seconds" ] } }, { "if": { "properties": { "type": { "const": "DELETE" } } }, "then": { "required": [ "deployment_id" ] } }, { "if": { "properties": { "type": { "const": "REGISTER_ARTIFACT" } } }, "then": { "required": [ "repository", "reference" ] } }, { "if": { "properties": { "type": { "const": "RETAIN_ARTIFACT" } } }, "then": { "required": [ "repository", "digest", "retention_seconds" ] } }, { "if": { "properties": { "type": { "not": { "const": "DEPLOY" } } }, "required": [ "type" ] }, "then": { "not": { "anyOf": [ { "required": [ "http" ] }, { "required": [ "health" ] }, { "required": [ "routes" ] }, { "required": [ "configs" ] }, { "required": [ "secrets" ] } ] } } }, { "if": { "properties": { "type": { "enum": [ "ACQUIRE_LEASE", "RENEW_LEASE", "RESIZE_LEASE" ] } } }, "then": { "required": [ "deployment_id", "quote_id", "quote_digest" ] } }, { "if": { "properties": { "type": { "not": { "const": "DEPLOY_VERSION" } } }, "required": [ "type" ] }, "then": { "not": { "required": [ "inputs" ] } } } ], "properties": { "configs": { "description": "DEPLOY-only immutable non-secret references, strictly ascending by version_id. Omission means empty; null is invalid. Owner, lifecycle, digest and collision-free destinations are validated before Kubernetes mutation. Valid bindings materialize deterministic immutable ConfigMaps for the pinned revision. No inline env values are accepted in actions.", "items": { "$ref": "#/components/schemas/TupleConfigBinding" }, "type": "array", "uniqueItems": true }, "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "description": { "description": "Optional public description of what the service does and when to invoke it", "maxLength": 500, "type": "string" }, "digest": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "health": { "$ref": "#/components/schemas/DeploymentHealth" }, "http": { "$ref": "#/components/schemas/DeploymentHTTP" }, "image_digest": { "pattern": "^[^@]+@sha256:[0-9a-f]{64}$", "type": "string" }, "input": { "$ref": "#/components/schemas/JSONValue" }, "inputs": { "$ref": "#/components/schemas/DeploymentInputs", "description": "DEPLOY_VERSION only. Omission expands committed inputs after creation signing of the original request. Owner response omits the expanded payload. Supply and retain complete explicit inputs for locally reviewable commitments and verify returned digests. Legacy prepared actions without signed inputs require reprepare; execution never inherits mutable current inputs." }, "name": { "description": "Optional public service name; Cynder generates a stable name from the deployment ID when omitted", "maxLength": 80, "minLength": 1, "type": "string" }, "profile_name": { "maxLength": 80, "minLength": 1, "type": "string" }, "quote_digest": { "$ref": "#/components/schemas/Digest" }, "quote_id": { "$ref": "#/components/schemas/Digest" }, "reference": { "description": "Canonical immutable OCI manifest digest; the fetched manifest bytes must hash to this exact digest", "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "repository": { "minLength": 1, "type": "string" }, "requested_scopes": { "items": { "enum": [ "deploy", "invoke", "artifact" ], "type": "string" }, "maxItems": 3, "minItems": 1, "type": "array", "uniqueItems": true }, "resource_class": { "enum": [ "mvi-small" ], "type": "string" }, "retention_seconds": { "maximum": 31536000, "minimum": 60, "type": "integer" }, "routes": { "description": "Bounded public workload operation manifest shown by the deployment explorer", "items": { "$ref": "#/components/schemas/PublicRoute" }, "maxItems": 32, "type": "array", "uniqueItems": true }, "secrets": { "description": "DEPLOY-only opaque secret-version references, strictly ascending by version_id. Omission means empty; null is invalid. No secret contents or content hashes. Owner, lifecycle, expiry, integrity and collision-free destinations are validated before Kubernetes mutation. Valid bindings materialize deterministic immutable Secrets for the pinned revision. Custody rotation does not automatically roll out deployments.", "items": { "$ref": "#/components/schemas/TupleSecretBinding" }, "type": "array", "uniqueItems": true }, "source_tag": { "description": "Complete mutable OCI tag reference in the same repository as image_digest; Cynder resolves it and verifies the digest before version deployment", "example": "registry.example/workload:v2", "maxLength": 128, "minLength": 1, "pattern": "^[^@]+:[A-Za-z0-9_][A-Za-z0-9._-]{0,127}$", "type": "string" }, "tags": { "items": { "pattern": "^[a-z0-9][a-z0-9-]{0,31}$", "type": "string" }, "maxItems": 8, "type": "array", "uniqueItems": true }, "terms_accepted": { "const": true, "type": "boolean" }, "timeout_seconds": { "maximum": 300, "minimum": 1, "type": "integer" }, "type": { "enum": [ "DEPLOY", "DEPLOY_VERSION", "ROLLBACK_VERSION", "ENROLL_WALLET", "INVOKE", "DELETE", "REGISTER_ARTIFACT", "RETAIN_ARTIFACT", "ACQUIRE_LEASE", "RENEW_LEASE", "RESIZE_LEASE" ], "type": "string" }, "version_id": { "$ref": "#/components/schemas/VersionID" } }, "required": [ "type" ], "type": "object" }, "CreateConfigRequest": { "additionalProperties": false, "properties": { "env": { "$ref": "#/components/schemas/ConfigEnvironment" } }, "required": [ "env" ], "type": "object" }, "DedicatedActivationReadiness": { "additionalProperties": false, "description": "Exact lease-authorized activation target, bound by store commit to the durable candidate and previous binding; does not replace immutable source tuple identities.", "properties": { "activation_id": { "$ref": "#/components/schemas/ActionID" }, "fence": { "minimum": 1, "type": "integer" }, "lease_id": { "minLength": 1, "type": "string" }, "namespace": { "minLength": 1, "type": "string" }, "previous_binding_digest": { "$ref": "#/components/schemas/TupleDigest" }, "service": { "minLength": 1, "type": "string" } }, "required": [ "lease_id", "activation_id", "previous_binding_digest", "fence", "namespace", "service" ], "type": "object" }, "Deployment": { "additionalProperties": false, "description": "Signed-owner deployment allowlist. Internal routing, bindings and runtime output are excluded.", "properties": { "active_activation_id": { "$ref": "#/components/schemas/ActionID", "description": "Committed activation identity (the activating action ID), distinct from historical version and runtime revision. Rollback creates a new activation and runtime revision while reusing the historical version unchanged." }, "active_version_id": { "$ref": "#/components/schemas/VersionID" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "delete_pending": { "type": "boolean" }, "deleted": { "type": "boolean" }, "deploy_action_id": { "$ref": "#/components/schemas/ActionID" }, "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "description": { "maxLength": 500, "type": "string" }, "image_digest": { "type": "string" }, "name": { "maxLength": 80, "minLength": 1, "type": "string" }, "public_http": { "type": "boolean" }, "public_url": { "format": "uri", "type": "string" }, "resource_class": { "type": "string" }, "status": { "enum": [ "DEPLOYMENT_PENDING", "DEPLOYING", "READY", "DELETE_PENDING", "DELETING", "DELETED", "DEPLOYMENT_FAILED", "DELETE_FAILED" ], "type": "string" }, "tags": { "items": { "pattern": "^[a-z0-9][a-z0-9-]{0,31}$", "type": "string" }, "maxItems": 8, "type": "array", "uniqueItems": true }, "updated_at": { "$ref": "#/components/schemas/Timestamp" } }, "required": [ "deployment_id", "deploy_action_id", "image_digest", "resource_class", "status", "delete_pending", "deleted", "created_at", "updated_at" ], "type": "object" }, "DeploymentEvidence": { "additionalProperties": false, "properties": { "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "previous_active_version_id": { "$ref": "#/components/schemas/VersionID" }, "readiness": { "const": "ready", "type": "string" }, "tuple_digest": { "$ref": "#/components/schemas/TupleDigest" }, "version_id": { "$ref": "#/components/schemas/VersionID" } }, "required": [ "deployment_id", "version_id", "tuple_digest", "readiness" ], "type": "object" }, "DeploymentHTTP": { "additionalProperties": false, "properties": { "port": { "default": 8080, "description": "Workload container HTTP port", "maximum": 65535, "minimum": 1, "type": "integer" }, "public": { "const": true, "description": "Requests ordinary public HTTPS traffic at a Cynder-generated stable hostname", "type": "boolean" } }, "required": [ "public" ], "type": "object" }, "DeploymentHealth": { "additionalProperties": false, "properties": { "liveness_path": { "maxLength": 256, "pattern": "^/[^?#\\r\\n]*$", "type": "string" }, "readiness_path": { "default": "/health", "maxLength": 256, "pattern": "^/[^?#\\r\\n]*$", "type": "string" } }, "type": "object" }, "DeploymentID": { "pattern": "^dep_[0-9a-f]{32}$", "type": "string" }, "DeploymentInputs": { "additionalProperties": false, "description": "Complete signed desired-input snapshot for DEPLOY_VERSION, not a merge patch. Every nested member is required with exact case; null, unknown and duplicate members are rejected. Empty arrays and empty runtime_class are explicit. Config and secret bindings must be strictly ascending by version_id and resolve to owned, usable immutable versions. No secret values, key names or secret hashes. Policy digest must match the complete supported policy. Public/private mode and the stable public hostname cannot change; port, health and routes are pinned inputs. Each changed input participates in the action digest; execution uses this snapshot rather than process defaults or the then-current active version.", "properties": { "configs": { "items": { "$ref": "#/components/schemas/TupleConfigBinding" }, "type": "array", "uniqueItems": true }, "health": { "$ref": "#/components/schemas/TupleHealth" }, "http": { "$ref": "#/components/schemas/TupleHTTP" }, "policy": { "$ref": "#/components/schemas/TuplePolicy" }, "routes": { "items": { "$ref": "#/components/schemas/PublicRoute" }, "maxItems": 32, "type": "array", "uniqueItems": true }, "secrets": { "items": { "$ref": "#/components/schemas/TupleSecretBinding" }, "type": "array", "uniqueItems": true } }, "required": [ "configs", "secrets", "policy", "http", "routes", "health" ], "type": "object" }, "DeploymentTuple": { "additionalProperties": false, "description": "Complete immutable owner-private tuple, schema version 1. New successful DEPLOY stores exact configs/secrets and pinned object identity arrays; omitted bindings produce empty arrays, never placeholder references or implied defaults. Valid nonempty bindings materialize immutable ConfigMaps and Secrets for the exact revision. Badger plus the matching authorized external root remains canonical; Kubernetes objects are recoverable materializations. Namespace RBAC is not a per-owner ACL; owner isolation is enforced by the resolver. Active reconciliation uses this tuple, never mutable deployment projections. Missing legacy tuple evidence fails closed per deployment with explicit pinned-input redeploy guidance; no silent synthesis. Digest is sha256 plus colon and lowercase hex over compact Go encoding/json typed JSON (HTML escaping enabled, no trailing newline), with digest present as an empty string, UTC timestamps, and every other required field included. Optional readiness.traffic_pending is omitted when false; when true it follows runtime_revision before route_ready in typed JSON. It denotes candidate-only evidence. Object key order is the order of names in each schema's required array (including nested tuple schemas and PublicRoute), not displayed property order or lexicographic map order. Config and secret references must already be strictly ascending by version_id; reject duplicates or ambiguous ordering. Identity arrays remain index-aligned, never sorted independently. Routes sort by method then path. Policy digest uses its required-array order with its own digest empty. No secret contents or hashes derived from secret contents enter this digest.", "properties": { "action_digest": { "$ref": "#/components/schemas/Digest" }, "action_id": { "$ref": "#/components/schemas/ActionID" }, "configs": { "items": { "$ref": "#/components/schemas/TupleConfigBinding" }, "type": "array", "uniqueItems": true }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "digest": { "$ref": "#/components/schemas/TupleDigest" }, "health": { "$ref": "#/components/schemas/TupleHealth" }, "http": { "$ref": "#/components/schemas/TupleHTTP" }, "identities": { "$ref": "#/components/schemas/TupleIdentities" }, "image_digest": { "pattern": "^[^@]+@sha256:[0-9a-f]{64}$", "type": "string" }, "owner": { "minLength": 1, "type": "string" }, "policy": { "$ref": "#/components/schemas/TuplePolicy" }, "readiness": { "$ref": "#/components/schemas/TupleReadiness" }, "routes": { "items": { "$ref": "#/components/schemas/PublicRoute" }, "maxItems": 32, "type": "array", "uniqueItems": true }, "schema_version": { "const": 1, "type": "integer" }, "secrets": { "items": { "$ref": "#/components/schemas/TupleSecretBinding" }, "type": "array", "uniqueItems": true }, "source_tag": { "description": "Provenance only; empty on initial DEPLOY", "never desired image authority": null, "type": "string" }, "version_id": { "$ref": "#/components/schemas/VersionID" } }, "required": [ "schema_version", "digest", "version_id", "deployment_id", "owner", "action_id", "action_digest", "created_at", "image_digest", "source_tag", "configs", "secrets", "policy", "http", "routes", "health", "identities", "readiness" ], "type": "object" }, "DeploymentVersion": { "additionalProperties": false, "description": "Owner-only immutable historical version summary. Only the tuple digest is returned; the complete tuple and its original readiness stay in persistence. Rollback retains this version unchanged while creating a fresh activation and runtime revision. Retained versions pin config and secret references but do not override revocation, expiry or integrity checks at use. Legacy image-only versions may omit tuple_digest and fail closed without complete evidence.", "properties": { "action_id": { "$ref": "#/components/schemas/ActionID" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "image_digest": { "pattern": "^[^@]+@sha256:[0-9a-f]{64}$", "type": "string" }, "service_lease": { "$ref": "#/components/schemas/ServiceLeaseSummary" }, "tuple_digest": { "$ref": "#/components/schemas/TupleDigest" }, "version_id": { "$ref": "#/components/schemas/VersionID" } }, "required": [ "version_id", "deployment_id", "action_id", "image_digest", "created_at" ], "type": "object" }, "DeploymentVersionList": { "properties": { "active_version_id": { "$ref": "#/components/schemas/VersionID" }, "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "versions": { "items": { "$ref": "#/components/schemas/DeploymentVersion" }, "type": "array" } }, "required": [ "deployment_id", "active_version_id", "versions" ], "type": "object" }, "DeploymentVersionView": { "properties": { "active": { "type": "boolean" }, "version": { "$ref": "#/components/schemas/DeploymentVersion" } }, "required": [ "active", "version" ], "type": "object" }, "Digest": { "pattern": "^[0-9a-f]{64}$", "type": "string" }, "Error": { "additionalProperties": false, "properties": { "error": { "additionalProperties": false, "properties": { "code": { "type": "string" }, "message": { "type": "string" } }, "required": [ "code", "message" ], "type": "object" } }, "required": [ "error" ], "type": "object" }, "ExplorerSearchResult": { "additionalProperties": false, "properties": { "action_ids": { "items": { "$ref": "#/components/schemas/ActionID" }, "type": "array" }, "id": { "maxLength": 128, "minLength": 1, "type": "string" }, "kind": { "enum": [ "transaction", "settlement", "deployment", "artifact", "receipt" ], "type": "string" } }, "required": [ "kind", "id", "action_ids" ], "type": "object" }, "Health": { "additionalProperties": false, "properties": { "roles": { "description": "Comma-separated active cynderd roles; present on registry-only processes.", "type": "string" }, "status": { "const": "ok", "type": "string" } }, "required": [ "status" ], "type": "object" }, "JSONValue": {}, "LeaseActionRequest": { "additionalProperties": false, "description": "Prepared through POST /v1/actions; execute only through existing signed, budget-approved x402 handshake. Signing action names acquire_lease / renew_lease / resize_lease; dynamic quote amount, never legacy deploy price. RESIZE_LEASE payment requires ReadyResize prerequisites; settled scheduling returns 202 WAITING_EFFECTIVE_TIME and recovery completes only activation. Missing prerequisites fail before new payment. Existing uncertain settlement uses reconciliation only, never resubmission. The node-backed resize adapter is opt-in and requires installed enforcing prerequisites.", "properties": { "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "quote_digest": { "$ref": "#/components/schemas/Digest" }, "quote_id": { "$ref": "#/components/schemas/Digest" }, "type": { "enum": [ "ACQUIRE_LEASE", "RENEW_LEASE", "RESIZE_LEASE" ], "type": "string" } }, "required": [ "type", "deployment_id", "quote_id", "quote_digest" ], "type": "object" }, "LeaseAmendment": { "additionalProperties": false, "description": "Server-derived signed next-period amendment. EffectiveAt equals incumbent paid-through; EndsAt equals EffectiveAt plus quoted duration.", "properties": { "EffectiveAt": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "EndsAt": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ID": { "type": "string" }, "PreviousResourceID": { "type": "string" } }, "required": [ "ID", "PreviousResourceID", "EffectiveAt", "EndsAt" ], "type": "object" }, "LeaseAtomicAmount": { "description": "Canonical unsigned decimal asset atomic units; no floats or rounding.", "pattern": "^(0|[1-9][0-9]*)$", "type": "string" }, "LeaseItemizedPrice": { "additionalProperties": false, "description": "Deterministic order is CPU, MEMORY, EPHEMERAL, STORAGE sorted by VolumeID, then FEE (including explicit zero fee). Compute sums the first three items; Storage sums only STORAGE items; Total = Compute + Storage + Fee = quote Amount. No omitted, duplicated, reordered or extra items are accepted.", "properties": { "Compute": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Fee": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Items": { "items": { "$ref": "#/components/schemas/LeasePriceItem" }, "minItems": 4, "type": "array" }, "PolicyDigest": { "type": "string" }, "Storage": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Total": { "$ref": "#/components/schemas/LeaseAtomicAmount" } }, "required": [ "Compute", "Storage", "Fee", "Total", "PolicyDigest", "Items" ], "type": "object" }, "LeasePolicy": { "additionalProperties": false, "description": "Owner-private capability discovery, not an enable switch, reservation, price quote or deployment/resource eligibility guarantee. Both enabled flags and ACQUIRE_LEASE/RENEW_LEASE follow LeaseCoordinator.Ready; RESIZE_LEASE additionally requires ReadyResize. A ready response has disabled_reason empty and pricing_policy equal to the actual validated operator snapshot (PascalCase keys). Disabled responses retain both flags false, disabled_reason lease_admission_not_configured_or_integrated, pricing_policy null and supported_paid_operations []. No defaults or prices are synthesized. Readiness is rechecked on each request; runtime readiness errors disable discovery without exposing private details. Per-request preflight still rejects public HTTP, unsupported volume shapes, missing material or storage authority and stale/unavailable evidence before payment. Policy GET does not run preflight or reserve capacity. Daemon prerequisites are opt-in and require verified installed enforcement. Legacy policy remains LEAVE_UNCHANGED. Never automatically downgrade signing or pay from this response.", "properties": { "admission_enabled": { "type": "boolean" }, "disabled_reason": { "type": "string" }, "legacy_policy": { "enum": [ "LEAVE_UNCHANGED" ], "type": "string" }, "pricing_policy": { "oneOf": [ { "$ref": "#/components/schemas/LeasePricingPolicySnapshot" }, { "type": "null" } ] }, "quote_enabled": { "type": "boolean" }, "schema_version": { "type": "string" }, "supported_paid_operations": { "items": { "enum": [ "ACQUIRE_LEASE", "RENEW_LEASE", "RESIZE_LEASE" ], "type": "string" }, "type": "array", "uniqueItems": true } }, "required": [ "schema_version", "admission_enabled", "quote_enabled", "disabled_reason", "legacy_policy", "pricing_policy", "supported_paid_operations" ], "type": "object" }, "LeasePriceItem": { "additionalProperties": false, "description": "Amount = Rate * Units * Seconds * Multiplier with arbitrary-precision integer arithmetic. Compute Units are per-replica requests, Seconds is quote Duration and Multiplier is max_instances, never min_instances or limits. STORAGE Units is declared volume size, Seconds is StorageDuration and Multiplier is one. FEE Rate is the explicit flat fee; all three factors are one. VolumeID/Tier are empty except for STORAGE, where both must match the sorted resource volume and policy tier. No usage overages or refunds are implied by this price evidence.", "properties": { "Amount": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Kind": { "enum": [ "CPU", "MEMORY", "EPHEMERAL", "STORAGE", "FEE" ], "type": "string" }, "Multiplier": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Rate": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Seconds": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Tier": { "type": "string" }, "Units": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "VolumeID": { "type": "string" } }, "required": [ "Kind", "VolumeID", "Tier", "Rate", "Units", "Seconds", "Multiplier", "Amount" ], "type": "object" }, "LeasePricingPolicySnapshot": { "additionalProperties": false, "description": "Exact existing cynder-pricing-policy/v1 data; no implicit defaults. CPU rate is atomic units per millicore-second; memory, ephemeral and storage rates are per byte-second. Fee is one explicit flat atomic-unit charge.", "properties": { "ActivationWindow": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Asset": { "type": "string" }, "CPU": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "CapacityPolicy": { "type": "string" }, "Ephemeral": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Fee": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Grace": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ID": { "type": "string" }, "MaxDuration": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Memory": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "MinDuration": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Network": { "type": "string" }, "Payee": { "type": "string" }, "Provider": { "type": "string" }, "RefundPolicy": { "type": "string" }, "Storage": { "additionalProperties": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "description": "Tier to rate map; null and empty map retain distinct existing policy digest bytes. Every attached volume requires an explicit tier rate.", "type": [ "object", "null" ] }, "TrafficPolicy": { "type": "string" }, "Version": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" } }, "required": [ "ID", "Provider", "Network", "Asset", "Payee", "RefundPolicy", "TrafficPolicy", "CapacityPolicy", "Version", "MinDuration", "MaxDuration", "Grace", "ActivationWindow", "CPU", "Memory", "Ephemeral", "Fee", "Storage" ], "type": "object" }, "LeaseQuote": { "description": "New issuance returns itemized v2. Durable idempotent replay may return the exact historical unversioned v1 quote, never an upgraded digest.", "oneOf": [ { "$ref": "#/components/schemas/LeaseQuoteV2" }, { "$ref": "#/components/schemas/LeaseQuoteLegacy" } ] }, "LeaseQuoteBreakdown": { "additionalProperties": false, "description": "Immutable non-secret snapshots are persisted with the quote. Recompute policy digest from Policy using cynder-pricing-policy/v1 plus newline and sorted-key JSON; recompute Resource identity as documented by ResourceSpec. Policy and resource identity, totals, duration, currency, provider, payee, grace, traffic/refund policies and activation window must match the quote. StorageDuration is zero for compute-only issuance. For exactly one already independently funded volume, IndependentStorage is true, Resource retains the volume and storage obligation identity, and Price.Storage remains zero with no STORAGE item. IndependentStorage is absent for empty-volume quotes; absence with a volume is invalid. This quote never purchases or extends storage funding. Public HTTP with volumes remains unsupported.", "properties": { "IndependentStorage": { "const": true, "description": "Present only for an independently funded single-volume compute quote.", "type": "boolean" }, "Policy": { "$ref": "#/components/schemas/LeasePricingPolicySnapshot" }, "Price": { "$ref": "#/components/schemas/LeaseItemizedPrice" }, "Resource": { "$ref": "#/components/schemas/ResourceSpec" }, "StorageDuration": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" } }, "required": [ "Policy", "Resource", "StorageDuration", "Price" ], "type": "object" }, "LeaseQuoteLegacy": { "additionalProperties": false, "description": "Exact Go wire keys are PascalCase. Amount is decimal atomic units. Digest = SHA256(cynder-lease-quote/v1 + newline + sorted-key JSON of all fields with Digest set to empty string). Quote is a capacity reservation, NOT settlement or activation. Historical quotes omit SchemaVersion and Breakdown; their signed bytes are preserved. Identical idempotency replay retains the original quote and TTL, including expired quotes. Changed request bodies conflict.", "properties": { "ActivationDeadline": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Amount": { "type": "string" }, "Asset": { "type": "string" }, "Deployment": { "type": "string" }, "Digest": { "type": "string" }, "Duration": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ExpectedSeq": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ExpiresAt": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Grace": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "HoldID": { "type": "string" }, "ID": { "type": "string" }, "LeaseID": { "type": "string" }, "Network": { "type": "string" }, "Operation": { "type": "string" }, "Owner": { "type": "string" }, "Payee": { "type": "string" }, "PolicyDigest": { "type": "string" }, "PredecessorPaidThrough": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Provider": { "type": "string" }, "RefundPolicy": { "type": "string" }, "ResourceID": { "type": "string" }, "TrafficPolicy": { "type": "string" } }, "required": [ "ID", "Digest", "Owner", "Deployment", "ResourceID", "Provider", "HoldID", "LeaseID", "Operation", "PolicyDigest", "Network", "Asset", "Payee", "Amount", "RefundPolicy", "TrafficPolicy", "ExpectedSeq", "Duration", "Grace", "ExpiresAt", "ActivationDeadline", "PredecessorPaidThrough" ], "type": "object" }, "LeaseQuoteRequest": { "additionalProperties": false, "properties": { "duration_seconds": { "maximum": 9007199254740991, "minimum": 1, "type": "integer" }, "operation": { "enum": [ "ACQUIRE", "RENEW", "RESIZE" ], "type": "string" }, "resource_spec": { "$ref": "#/components/schemas/ResourceSpec" } }, "required": [ "operation", "resource_spec", "duration_seconds" ], "type": "object" }, "LeaseQuoteV2": { "additionalProperties": false, "allOf": [ { "else": { "not": { "required": [ "Amendment" ] } }, "if": { "properties": { "Operation": { "const": "RESIZE" } }, "required": [ "Operation" ] }, "then": { "required": [ "Amendment" ] } } ], "description": "PascalCase wire fields. SHA256 of cynder-lease-quote/v2 plus newline plus sorted-key canonical JSON of ALL fields with Digest set to empty string, including SchemaVersion and the complete Breakdown. Same constrained printable-ASCII, safe-integer canonicalization as v1. No signatures in this object; the authenticated control origin and owner action signature remain required. Hash consistency does not authorize rates or payment.", "properties": { "ActivationDeadline": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Amendment": { "$ref": "#/components/schemas/LeaseAmendment" }, "Amount": { "$ref": "#/components/schemas/LeaseAtomicAmount" }, "Asset": { "type": "string" }, "Breakdown": { "$ref": "#/components/schemas/LeaseQuoteBreakdown" }, "Deployment": { "type": "string" }, "Digest": { "type": "string" }, "Duration": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ExpectedSeq": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ExpiresAt": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Grace": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "HoldID": { "type": "string" }, "ID": { "type": "string" }, "LeaseID": { "type": "string" }, "Network": { "type": "string" }, "Operation": { "enum": [ "ACQUIRE", "RENEW", "RESIZE" ], "type": "string" }, "Owner": { "type": "string" }, "Payee": { "type": "string" }, "PolicyDigest": { "type": "string" }, "PredecessorPaidThrough": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "Provider": { "type": "string" }, "RefundPolicy": { "type": "string" }, "ResourceID": { "type": "string" }, "SchemaVersion": { "enum": [ "cynder-lease-quote/v2" ], "type": "string" }, "TrafficPolicy": { "type": "string" } }, "required": [ "SchemaVersion", "Breakdown", "ID", "Digest", "Owner", "Deployment", "ResourceID", "Provider", "HoldID", "LeaseID", "Operation", "PolicyDigest", "Network", "Asset", "Payee", "Amount", "RefundPolicy", "TrafficPolicy", "ExpectedSeq", "Duration", "Grace", "ExpiresAt", "ActivationDeadline", "PredecessorPaidThrough" ], "type": "object" }, "LeaseReplica": { "additionalProperties": false, "properties": { "cpu_limit_millicores": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "cpu_request_millicores": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ephemeral_limit_bytes": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "ephemeral_request_bytes": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "memory_limit_bytes": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "memory_request_bytes": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" } }, "required": [ "cpu_request_millicores", "cpu_limit_millicores", "memory_request_bytes", "memory_limit_bytes", "ephemeral_request_bytes", "ephemeral_limit_bytes" ], "type": "object" }, "LeaseVolume": { "additionalProperties": false, "properties": { "access_mode": { "type": "string" }, "mount_path": { "type": "string" }, "retention_policy_id": { "type": "string" }, "size_bytes": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "storage_obligation_id": { "type": "string" }, "tier_id": { "type": "string" }, "volume_id": { "type": "string" } }, "required": [ "volume_id", "tier_id", "mount_path", "access_mode", "retention_policy_id", "storage_obligation_id", "size_bytes" ], "type": "object" }, "PublicActionDetail": { "additionalProperties": false, "properties": { "action": { "$ref": "#/components/schemas/PublicActionSummary" }, "timeline": { "items": { "$ref": "#/components/schemas/PublicReceiptEvent" }, "type": "array" } }, "required": [ "action", "timeline" ], "type": "object" }, "PublicActionList": { "additionalProperties": false, "properties": { "actions": { "items": { "$ref": "#/components/schemas/PublicActionSummary" }, "type": "array" }, "limit": { "maximum": 50, "minimum": 1, "type": "integer" } }, "required": [ "actions", "limit" ], "type": "object" }, "PublicActionSummary": { "additionalProperties": false, "properties": { "action_id": { "$ref": "#/components/schemas/ActionID" }, "amount_atomic": { "pattern": "^[0-9]*$", "type": "string" }, "artifact_id": { "$ref": "#/components/schemas/ArtifactID" }, "asset": { "type": "string" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "failure_code": { "$ref": "#/components/schemas/PublicFailureCode" }, "failure_message": { "$ref": "#/components/schemas/PublicFailureMessage" }, "network": { "type": "string" }, "payment_status": { "enum": [ "SETTLED" ], "type": "string" }, "refund": { "$ref": "#/components/schemas/RefundStatus" }, "service_lease": { "$ref": "#/components/schemas/ServiceLeaseSummary" }, "settlement_tx_hash": { "pattern": "^0x[0-9a-fA-F]{64}$", "type": "string" }, "status": { "enum": [ "SUCCEEDED", "FAILED" ], "type": "string" }, "type": { "enum": [ "DEPLOY", "DEPLOY_VERSION", "ROLLBACK_VERSION", "INVOKE", "DELETE", "REGISTER_ARTIFACT", "RETAIN_ARTIFACT", "ACQUIRE_LEASE", "RENEW_LEASE", "RESIZE_LEASE" ], "type": "string" }, "updated_at": { "$ref": "#/components/schemas/Timestamp" } }, "required": [ "action_id", "type", "status", "payment_status", "amount_atomic", "network", "asset", "created_at", "updated_at" ], "type": "object" }, "PublicArtifactList": { "additionalProperties": false, "properties": { "artifacts": { "items": { "$ref": "#/components/schemas/PublicArtifactSummary" }, "type": "array" }, "limit": { "maximum": 50, "minimum": 1, "type": "integer" } }, "required": [ "artifacts", "limit" ], "type": "object" }, "PublicArtifactSummary": { "additionalProperties": false, "properties": { "artifact_id": { "$ref": "#/components/schemas/ArtifactID" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "signature_status": { "type": "string" }, "size_bytes": { "minimum": 0, "type": "integer" }, "status": { "type": "string" }, "updated_at": { "$ref": "#/components/schemas/Timestamp" }, "vulnerability_status": { "type": "string" } }, "required": [ "artifact_id", "status", "size_bytes", "created_at", "updated_at" ], "type": "object" }, "PublicDeploymentChange": { "additionalProperties": false, "properties": { "action_id": { "$ref": "#/components/schemas/ActionID" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "kind": { "enum": [ "INITIAL", "DEPLOY_VERSION", "ROLLBACK_VERSION" ], "type": "string" }, "previous_version_id": { "$ref": "#/components/schemas/VersionID" }, "summary": { "type": "string" }, "title": { "type": "string" }, "version_id": { "$ref": "#/components/schemas/VersionID" } }, "required": [ "kind", "title", "summary", "action_id", "version_id", "created_at" ], "type": "object" }, "PublicDeploymentDetail": { "additionalProperties": false, "properties": { "changelog": { "items": { "$ref": "#/components/schemas/PublicDeploymentChange" }, "type": "array" }, "deployment": { "$ref": "#/components/schemas/PublicDeploymentSummary" }, "description": { "maxLength": 500, "type": "string" }, "service_lease": { "$ref": "#/components/schemas/ServiceLeaseProjection" }, "tags": { "items": { "pattern": "^[a-z0-9][a-z0-9-]{0,31}$", "type": "string" }, "maxItems": 8, "type": "array", "uniqueItems": true }, "transactions": { "items": { "$ref": "#/components/schemas/PublicActionSummary" }, "type": "array" }, "versions": { "items": { "$ref": "#/components/schemas/PublicDeploymentVersion" }, "type": "array" } }, "required": [ "deployment", "changelog", "versions", "transactions" ], "type": "object" }, "PublicDeploymentList": { "additionalProperties": false, "properties": { "deployments": { "items": { "$ref": "#/components/schemas/PublicDeploymentSummary" }, "type": "array" }, "limit": { "maximum": 50, "minimum": 1, "type": "integer" } }, "required": [ "deployments", "limit" ], "type": "object" }, "PublicDeploymentSummary": { "additionalProperties": false, "properties": { "active_version_id": { "$ref": "#/components/schemas/VersionID" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "deleted_at": { "$ref": "#/components/schemas/Timestamp" }, "deploy_action_id": { "$ref": "#/components/schemas/ActionID" }, "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "liveness_path": { "pattern": "^/", "type": "string" }, "name": { "maxLength": 80, "minLength": 1, "type": "string" }, "public_http": { "type": "boolean" }, "public_url": { "format": "uri", "pattern": "^https://", "type": "string" }, "readiness_path": { "pattern": "^/", "type": "string" }, "route_status": { "type": "string" }, "routes": { "items": { "$ref": "#/components/schemas/PublicRoute" }, "maxItems": 32, "type": "array", "uniqueItems": true }, "service_lease": { "$ref": "#/components/schemas/ServiceLeaseSummary" }, "status": { "type": "string" }, "updated_at": { "$ref": "#/components/schemas/Timestamp" } }, "required": [ "deployment_id", "name", "status", "deploy_action_id", "created_at", "updated_at" ], "type": "object" }, "PublicDeploymentVersion": { "additionalProperties": false, "properties": { "action_id": { "$ref": "#/components/schemas/ActionID" }, "active": { "type": "boolean" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "service_lease": { "$ref": "#/components/schemas/ServiceLeaseSummary" }, "version_id": { "$ref": "#/components/schemas/VersionID" } }, "required": [ "version_id", "action_id", "active", "created_at" ], "type": "object" }, "PublicFailureCode": { "enum": [ "ACTION_FAILED", "RUNTIME_REJECTED", "READINESS_REJECTED", "RECOVERY_EXHAUSTED", "REGISTRATION_MANIFEST_UNAVAILABLE", "REGISTRATION_BLOB_UNAVAILABLE", "REGISTRATION_DIGEST_MISMATCH", "REGISTRATION_VALIDATION_FAILED" ], "type": "string" }, "PublicFailureMessage": { "enum": [ "The action failed after payment settlement.", "The runtime rejected this deployment.", "The deployment did not pass its readiness check.", "The deployment outcome could not be confirmed.", "The immutable manifest could not be read.", "A required artifact blob could not be verified.", "The requested immutable digest did not match the manifest.", "The artifact failed validation." ], "type": "string" }, "PublicReceiptEvent": { "additionalProperties": false, "properties": { "created_at": { "$ref": "#/components/schemas/Timestamp" }, "failure_code": { "$ref": "#/components/schemas/PublicFailureCode" }, "failure_message": { "$ref": "#/components/schemas/PublicFailureMessage" }, "kind": { "$ref": "#/components/schemas/ReceiptKind" }, "receipt_id": { "$ref": "#/components/schemas/ReceiptID" }, "status": { "enum": [ "PENDING", "EXECUTING", "WAITING_EFFECTIVE_TIME", "SUCCEEDED", "FAILED", "UNKNOWN" ], "type": "string" } }, "required": [ "receipt_id", "kind", "status", "created_at" ], "type": "object" }, "PublicRoute": { "additionalProperties": false, "properties": { "method": { "enum": [ "GET", "HEAD", "POST", "PUT", "PATCH", "DELETE", "OPTIONS" ], "type": "string" }, "path": { "maxLength": 256, "pattern": "^/[^?#\\r\\n]*$", "type": "string" } }, "required": [ "method", "path" ], "type": "object" }, "Ready": { "additionalProperties": false, "properties": { "roles": { "description": "Comma-separated active cynderd roles; present on registry-only processes.", "type": "string" }, "status": { "const": "ready", "type": "string" } }, "required": [ "status" ], "type": "object" }, "Receipt": { "additionalProperties": false, "description": "Owner receipt allowlist includes safe version 3 digest inputs and output commitments, not raw replay output. Legacy receipts omit private preimages and require internal custody for verification. See docs/private-operations.md.", "properties": { "action_digest": { "$ref": "#/components/schemas/Digest" }, "action_evidence": { "additionalProperties": false, "properties": { "output_sha256": { "pattern": "^[0-9a-f]{64}$", "type": "string" } }, "required": [ "output_sha256" ], "type": "object" }, "action_id": { "$ref": "#/components/schemas/ActionID" }, "completed_at": { "$ref": "#/components/schemas/Timestamp" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "deployment_evidence": { "$ref": "#/components/schemas/DeploymentEvidence" }, "deployment_id": { "type": "string" }, "digest": { "$ref": "#/components/schemas/Digest" }, "error": { "enum": [ "action transition failed", "REGISTRATION_MANIFEST_UNAVAILABLE", "REGISTRATION_BLOB_UNAVAILABLE", "REGISTRATION_DIGEST_MISMATCH", "REGISTRATION_VALIDATION_FAILED" ], "type": "string" }, "final_status": { "type": "string" }, "kind": { "$ref": "#/components/schemas/ReceiptKind" }, "node_id": { "type": "string" }, "output": { "additionalProperties": false, "properties": { "artifact_id": { "$ref": "#/components/schemas/ArtifactID" } }, "required": [ "artifact_id" ], "type": "object" }, "payee": { "type": "string" }, "payer": { "type": "string" }, "payment_id": { "type": "string" }, "payment_status": { "enum": [ "UNPAID", "SETTLING", "SETTLED", "SETTLEMENT_UNKNOWN" ], "type": "string" }, "previous_receipt_digest": { "$ref": "#/components/schemas/Digest" }, "receipt_id": { "$ref": "#/components/schemas/ReceiptID" }, "receipt_type": { "$ref": "#/components/schemas/ReceiptType" }, "receipt_version": { "enum": [ "1", "2", "3" ], "type": "string" }, "recovery_evidence": { "additionalProperties": false, "properties": { "previous_failed_receipt_digest": { "$ref": "#/components/schemas/Digest" }, "previous_failed_sequence": { "minimum": 1, "type": "integer" }, "recovery": { "const": "OWNER_AUTHORIZED_REGISTRATION", "type": "string" } }, "required": [ "recovery", "previous_failed_sequence", "previous_failed_receipt_digest" ], "type": "object" }, "sequence": { "minimum": 1, "type": "integer" }, "settlement_hash": { "type": "string" }, "started_at": { "$ref": "#/components/schemas/Timestamp" }, "status": { "$ref": "#/components/schemas/ActionStatus" }, "usdc_amount": { "type": "string" } }, "required": [ "receipt_version", "receipt_type", "receipt_id", "action_id", "action_digest", "sequence", "kind", "status", "digest", "created_at", "final_status" ], "type": "object" }, "ReceiptID": { "pattern": "^rcpt_[0-9a-f]{32}$", "type": "string" }, "ReceiptKind": { "enum": [ "ACCEPTED", "EXECUTING", "WAITING_EFFECTIVE_TIME", "DISPATCHED", "COMPLETED", "FAILED", "UNKNOWN", "PAYMENT_SETTLING", "PAYMENT_SETTLEMENT_UNKNOWN", "PAYMENT_SETTLED" ], "type": "string" }, "ReceiptType": { "enum": [ "ACCEPTED", "EXECUTING", "WAITING_EFFECTIVE_TIME", "DISPATCHED", "COMPLETED", "FAILED", "UNKNOWN", "PAYMENT_SETTLING", "PAYMENT_SETTLEMENT_UNKNOWN", "PAYMENT_SETTLED", "DEPLOYMENT_RECEIPT", "INVOCATION_RECEIPT", "DELETION_RECEIPT" ], "type": "string" }, "RefundStatus": { "additionalProperties": false, "description": "Read-only refund obligation and transfer projection; never changes original SETTLED payment or action signing. Missing historical evidence is not confirmation. Policy is captured immutably at creation. No GET sends money.", "properties": { "amount": { "description": "Original service charge in atomic units; gas is separate.", "pattern": "^[0-9]+$", "type": "string" }, "asset": { "type": "string" }, "blocker": { "enum": [ "EXECUTION_DISABLED_OR_UNCONFIGURED", "TRANSFER_RECONCILIATION_REQUIRED", "CANONICAL_TRANSFER_REVERTED" ], "type": "string" }, "confirmation_state": { "type": "string" }, "created_at": { "$ref": "#/components/schemas/Timestamp" }, "network": { "type": "string" }, "original_payment_reference": { "type": "string" }, "policy_version": { "type": "string" }, "reason": { "type": "string" }, "status": { "enum": [ "NOT_APPLICABLE", "RECONCILIATION_REQUIRED", "REVIEW_REQUIRED", "OWED", "PENDING", "CONFIRMED" ], "type": "string" }, "transaction_hash": { "pattern": "^0x[0-9a-fA-F]{64}$", "type": "string" }, "updated_at": { "$ref": "#/components/schemas/Timestamp" } }, "required": [ "policy_version", "status", "reason", "created_at", "updated_at" ], "type": "object" }, "ResourceSpec": { "additionalProperties": false, "description": "Strict constrained canonical JSON: no duplicate/unknown/null fields; printable ASCII excluding quotes, backslash, \u003c, \u003e, \u0026; integers only. Positive requests \u003c= limits; limit * max_instances \u003c= safe integer maximum. Resource ID is SHA256(schema + newline + sorted-key canonical JSON excluding resource_spec_id, sorting volumes by volume_id). A supported single independently funded volume may be quoted for compute only after owner-bound storage authority, coverage, capacity and installed enforcing runtime preflight. Unsupported shapes, RESIZE with volumes and public HTTP with volumes remain rejected. Capability discovery is not per-request preflight or proof of live enablement.", "properties": { "max_instances": { "maximum": 9007199254740991, "minimum": 1, "type": "integer" }, "min_instances": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "per_replica": { "$ref": "#/components/schemas/LeaseReplica" }, "resource_spec_id": { "$ref": "#/components/schemas/Digest" }, "schema_version": { "enum": [ "cynder-resource-spec/v1" ], "type": "string" }, "traffic_policy_id": { "type": "string" }, "volumes": { "items": { "$ref": "#/components/schemas/LeaseVolume" }, "type": "array" } }, "required": [ "schema_version", "per_replica", "min_instances", "max_instances", "traffic_policy_id", "volumes" ], "type": "object" }, "RetainConfigRequest": { "additionalProperties": false, "properties": { "retain_until": { "description": "RFC3339 timestamp with optional nanoseconds, normalized to UTC; year 1970 through 9999 and no earlier than the current retention deadline.", "format": "date-time", "type": "string" } }, "required": [ "retain_until" ], "type": "object" }, "ServiceLeaseActivationObservation": { "additionalProperties": false, "description": "Historical activation evidence at Unix seconds observed_at, never live readiness. Revision digest uses the same domain as ServiceLeaseBinding.", "properties": { "binding_digest": { "$ref": "#/components/schemas/ServiceLeaseRuntimeDigest" }, "observed_at": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "runtime_revision_digest": { "$ref": "#/components/schemas/ServiceLeaseRuntimeDigest" } }, "required": [ "binding_digest", "runtime_revision_digest", "observed_at" ], "type": "object" }, "ServiceLeaseAllocation": { "additionalProperties": false, "nullable": true, "properties": { "max_instances": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "min_instances": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "per_replica": { "$ref": "#/components/schemas/LeaseReplica" } }, "required": [ "per_replica", "min_instances", "max_instances" ], "type": "object" }, "ServiceLeaseBinding": { "additionalProperties": false, "description": "Immutable desired-state authority, not readiness. Revision digest is SHA256 of cynder-public-lease-revision/v1 followed by newline and the private runtime revision name. Raw service/revision names are never public.", "nullable": true, "properties": { "desired_runtime_revision_digest": { "$ref": "#/components/schemas/ServiceLeaseRuntimeDigest" }, "digest": { "$ref": "#/components/schemas/ServiceLeaseRuntimeDigest" }, "fence": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "resource_spec_digest": { "$ref": "#/components/schemas/Digest" }, "tuple_digest": { "$ref": "#/components/schemas/ServiceLeaseRuntimeDigest" }, "version_id": { "type": "string" } }, "required": [ "digest", "tuple_digest", "version_id", "resource_spec_digest", "fence", "desired_runtime_revision_digest" ], "type": "object" }, "ServiceLeaseCapabilities": { "additionalProperties": false, "description": "Configured acquire, renew and fresh-ACQUIRE reactivation follow Ready; resize additionally follows ReadyResize. Volumes require installed paid-storage wiring, not storage preflight or live evidence. Browser mutation controls are never enabled.", "properties": { "acquisition": { "type": "boolean" }, "browser_mutations": { "enum": [ false ], "type": "boolean" }, "renewal": { "type": "boolean" }, "resize": { "type": "boolean" }, "suspended_reactivation": { "type": "boolean" }, "volumes": { "type": "boolean" } }, "required": [ "acquisition", "renewal", "resize", "volumes", "suspended_reactivation", "browser_mutations" ], "type": "object" }, "ServiceLeaseHistoryEntry": { "additionalProperties": false, "properties": { "action_id": { "$ref": "#/components/schemas/ActionID" }, "activation_observation": { "$ref": "#/components/schemas/ServiceLeaseActivationObservation" }, "effective_from": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "effective_until": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "fence": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "grace_ends": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "lease_generation": { "$ref": "#/components/schemas/ServiceLeaseRuntimeDigest" }, "new_resource_spec_digest": { "$ref": "#/components/schemas/Digest" }, "old_resource_spec_digest": { "$ref": "#/components/schemas/Digest" }, "operation": { "enum": [ "ACQUIRE", "RENEW", "RESIZE" ], "type": "string" }, "paid_through": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "sequence": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "version_id": { "type": "string" } }, "required": [ "action_id", "operation", "paid_through", "grace_ends", "sequence", "fence", "lease_generation", "new_resource_spec_digest", "effective_from", "effective_until" ], "type": "object" }, "ServiceLeaseLiveObservation": { "additionalProperties": false, "description": "Independently collected, sanitized current observation. GET only reads records. FRESH requires current lease/binding identity and bounded age; READY additionally requires unexpired entitlement and matching runtime evidence. Storage READY additionally rechecks recorded authority identity. Missing, stale or mismatched evidence never implies readiness. Unix-second validity bounds require local browser expiry even if SSE stops.", "properties": { "binding_digest": { "$ref": "#/components/schemas/ServiceLeaseRuntimeDigest" }, "fence": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "freshness": { "enum": [ "MISSING", "UNAVAILABLE", "MISMATCHED", "STALE", "FRESH" ], "type": "string" }, "observed_at": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "runtime": { "enum": [ "UNKNOWN", "READY", "NOT_READY", "SUSPENDED", "UNAVAILABLE" ], "type": "string" }, "storage": { "enum": [ "UNKNOWN", "READY", "UNAVAILABLE", "NOT_APPLICABLE" ], "type": "string" }, "valid_until": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" } }, "required": [ "runtime", "storage", "freshness" ], "type": "object" }, "ServiceLeaseProjection": { "additionalProperties": false, "description": "Read-only stored entitlement snapshot, not live runtime usage or readiness. Zero-valued optional counters are omitted. Allocation is null until a paid-through entitlement exists, and remains historical after expiry. Binding is null when absent; revision digests hide private service names. History contains bounded public indexed committed acquisitions, renewals, reactivations and resizes across lease generations, not all attempts or payments. An empty list does not prove no operations. Current observations are collected independently of GET and accepted only for matching current identity and freshness. Admission and capabilities report configured coordinator gates, not live readiness or eligibility of this deployment. Reads do not preflight or pay.", "properties": { "admission_enabled": { "type": "boolean" }, "capabilities": { "$ref": "#/components/schemas/ServiceLeaseCapabilities" }, "classification": { "enum": [ "LEGACY_UNMANAGED", "SERVICE_LEASE" ], "type": "string" }, "current_observation": { "$ref": "#/components/schemas/ServiceLeaseLiveObservation" }, "disabled_reason": { "type": "string" }, "fence": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "grace_ends": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "history_limit": { "description": "Selected history page limit; zero for legacy deployments without a lease.", "maximum": 50, "minimum": 0, "type": "integer" }, "history_next_cursor": { "description": "Opaque continuation for the bounded public history scan. An empty page can have a continuation; follow it rather than assuming history is absent.", "type": "string" }, "history_scope": { "enum": [ "PUBLIC_INDEXED_COMMITTED_ACTIVATIONS_ONLY" ], "type": "string" }, "immutable_binding": { "$ref": "#/components/schemas/ServiceLeaseBinding" }, "paid_through": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "purchased_allocation": { "$ref": "#/components/schemas/ServiceLeaseAllocation" }, "renewal_history": { "items": { "$ref": "#/components/schemas/ServiceLeaseHistoryEntry" }, "type": "array" }, "resource_spec_id": { "$ref": "#/components/schemas/Digest" }, "runtime_observation": { "description": "Current readiness is unknown. Historical activation receipts never establish current READY.", "enum": [ "NOT_OBSERVED", "HISTORICAL_ONLY" ], "type": "string" }, "sequence": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "state": { "enum": [ "PENDING_PAYMENT", "SETTLEMENT_UNKNOWN", "PAID_PENDING_ACTIVATION", "ACTIVE", "GRACE", "SUSPENDING", "SUSPENDED", "PROVISION_FAILED" ], "type": "string" }, "storage_status": { "description": "Legacy storage is NOT_EVALUATED; no lease volumes is NOT_APPLICABLE. Missing or stale recorded authority is UNKNOWN; revoked, mismatched or unreadable authority is UNAVAILABLE. RECORDED_AUTHORIZED means matching unexpired recorded funding only, never live CSI or writer readiness.", "enum": [ "NOT_EVALUATED", "NOT_APPLICABLE", "UNKNOWN", "UNAVAILABLE", "RECORDED_AUTHORIZED" ], "type": "string" } }, "required": [ "classification", "admission_enabled", "disabled_reason", "runtime_observation", "storage_status", "purchased_allocation", "immutable_binding", "renewal_history", "history_scope", "capabilities" ], "type": "object" }, "ServiceLeaseRuntimeDigest": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "ServiceLeaseSummary": { "additionalProperties": false, "description": "Constant-size identity-scoped summary without history traversal. CURRENT_DEPLOYMENT describes current recorded authority; CURRENT_VERSION_BINDING requires an exact version binding. COMMITTED_ACTION describes only that historical action's activation, never today's entitlement or observation. Missing or unmatched evidence never fabricates readiness.", "properties": { "activation_observation": { "$ref": "#/components/schemas/ServiceLeaseActivationObservation" }, "classification": { "enum": [ "LEGACY_UNMANAGED", "SERVICE_LEASE", "UNAVAILABLE", "NO_MATCHING_CURRENT_LEASE" ], "type": "string" }, "current_observation": { "$ref": "#/components/schemas/ServiceLeaseLiveObservation" }, "grace_ends": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "paid_through": { "maximum": 9007199254740991, "minimum": 0, "type": "integer" }, "purchased_allocation": { "$ref": "#/components/schemas/ServiceLeaseAllocation" }, "resource_spec_id": { "$ref": "#/components/schemas/Digest" }, "scope": { "enum": [ "CURRENT_DEPLOYMENT", "VERSION", "CURRENT_VERSION_BINDING", "COMMITTED_ACTION" ], "type": "string" }, "state": { "type": "string" } }, "required": [ "scope", "classification" ], "type": "object" }, "StoragePurchaseTypedItem": { "additionalProperties": false, "properties": { "Amount": { "type": "string" }, "Kind": { "enum": [ "STORAGE" ], "type": "string" }, "Multiplier": { "format": "uint64", "type": "integer" }, "Rate": { "type": "string" }, "Seconds": { "format": "uint64", "type": "integer" }, "Tier": { "type": "string" }, "Units": { "format": "uint64", "type": "integer" }, "VolumeID": { "type": "string" } }, "required": [ "Kind", "VolumeID", "Tier", "Rate", "Units", "Seconds", "Multiplier", "Amount" ], "type": "object" }, "StoragePurchaseTypedPolicy": { "additionalProperties": false, "properties": { "Asset": { "type": "string" }, "Digest": { "pattern": "^[a-f0-9]{64}$", "type": "string" }, "Fee": { "type": "string" }, "ID": { "type": "string" }, "MaxSeconds": { "format": "uint64", "type": "integer" }, "MinSeconds": { "format": "uint64", "type": "integer" }, "Network": { "type": "string" }, "Payee": { "type": "string" }, "Provider": { "type": "string" }, "QuoteSeconds": { "format": "uint64", "type": "integer" }, "Rate": { "type": "string" }, "RetentionPolicy": { "type": "string" }, "RetentionSeconds": { "format": "uint64", "type": "integer" }, "Tier": { "type": "string" }, "Version": { "format": "uint64", "type": "integer" } }, "required": [ "ID", "Version", "Provider", "Network", "Asset", "Payee", "Tier", "RetentionPolicy", "Rate", "Fee", "MinSeconds", "MaxSeconds", "RetentionSeconds", "QuoteSeconds", "Digest" ], "type": "object" }, "StoragePurchaseTypedQuote": { "additionalProperties": false, "properties": { "Asset": { "type": "string" }, "Digest": { "pattern": "^[a-f0-9]{64}$", "type": "string" }, "ExpiresAt": { "format": "uint64", "type": "integer" }, "Fee": { "type": "string" }, "ID": { "pattern": "^[a-f0-9]{64}$", "type": "string" }, "Item": { "$ref": "#/components/schemas/StoragePurchaseTypedItem" }, "Network": { "type": "string" }, "Payee": { "type": "string" }, "Policy": { "$ref": "#/components/schemas/StoragePurchaseTypedPolicy" }, "Request": { "$ref": "#/components/schemas/StoragePurchaseTypedRequest" }, "Schema": { "const": "cynder-storage-purchase/v1", "type": "string" }, "Total": { "type": "string" } }, "required": [ "Schema", "ID", "Digest", "Request", "Policy", "Item", "Fee", "Total", "Network", "Asset", "Payee", "ExpiresAt" ], "type": "object" }, "StoragePurchaseTypedRequest": { "additionalProperties": false, "description": "Authenticated owner request, including only the immutable custody commitment; no CSI binding fields.", "properties": { "CoverageEnds": { "format": "uint64", "type": "integer" }, "CoverageStarts": { "format": "uint64", "type": "integer" }, "CustodyDigest": { "pattern": "^[a-f0-9]{64}$", "type": "string" }, "Deployment": { "type": "string" }, "ExpectedSequence": { "format": "uint64", "type": "integer" }, "IdempotencyKey": { "type": "string" }, "Obligation": { "type": "string" }, "Owner": { "type": "string" }, "RetentionDeadline": { "format": "uint64", "type": "integer" }, "RetentionPolicy": { "type": "string" }, "Size": { "format": "uint64", "type": "integer" }, "Tier": { "type": "string" }, "Volume": { "type": "string" } }, "required": [ "Owner", "Deployment", "Obligation", "Volume", "Tier", "RetentionPolicy", "CustodyDigest", "Size", "ExpectedSequence", "CoverageStarts", "CoverageEnds", "RetentionDeadline", "IdempotencyKey" ], "type": "object" }, "StoragePurchaseView": { "additionalProperties": false, "description": "Owner-authenticated projection; typed_quote has only price, policy and the custody digest, never the private CSI binding or stored payment/intent record.", "properties": { "asset": { "type": "string" }, "coverage_ends": { "format": "uint64", "type": "integer" }, "coverage_starts": { "format": "uint64", "type": "integer" }, "deployment_id": { "type": "string" }, "expected_sequence": { "format": "uint64", "type": "integer" }, "expires_at": { "format": "uint64", "type": "integer" }, "fee": { "type": "string" }, "network": { "type": "string" }, "obligation_id": { "type": "string" }, "payee": { "type": "string" }, "policy_digest": { "type": "string" }, "policy_id": { "type": "string" }, "policy_version": { "format": "uint64", "type": "integer" }, "quote_digest": { "type": "string" }, "quote_id": { "type": "string" }, "rate": { "type": "string" }, "retention_deadline": { "format": "uint64", "type": "integer" }, "retention_policy": { "type": "string" }, "seconds": { "format": "uint64", "type": "integer" }, "size_bytes": { "format": "uint64", "type": "integer" }, "status": { "enum": [ "NOT_SUBMITTED" ], "type": "string" }, "storage_amount": { "type": "string" }, "tier": { "type": "string" }, "total": { "type": "string" }, "typed_quote": { "$ref": "#/components/schemas/StoragePurchaseTypedQuote" }, "units": { "format": "uint64", "type": "integer" }, "volume_id": { "type": "string" } }, "required": [ "typed_quote", "quote_id", "quote_digest", "obligation_id", "deployment_id", "volume_id", "tier", "retention_policy", "size_bytes", "expected_sequence", "coverage_starts", "coverage_ends", "retention_deadline", "policy_id", "policy_version", "policy_digest", "rate", "units", "seconds", "storage_amount", "fee", "total", "network", "asset", "payee", "expires_at", "status" ], "type": "object" }, "Timestamp": { "format": "date-time", "type": "string" }, "TupleConfigBinding": { "additionalProperties": false, "properties": { "digest": { "$ref": "#/components/schemas/TupleDigest" }, "mode": { "description": "env injects literal non-secret container values; envFrom uses envFrom.configMapRef to the immutable pinned ConfigMap.", "enum": [ "env", "envFrom" ], "type": "string" }, "version_id": { "$ref": "#/components/schemas/ConfigID" } }, "required": [ "version_id", "digest", "mode" ], "type": "object" }, "TupleDigest": { "pattern": "^sha256:[0-9a-f]{64}$", "type": "string" }, "TupleHTTP": { "additionalProperties": false, "properties": { "port": { "maximum": 65535, "minimum": 1, "type": "integer" }, "public": { "type": "boolean" }, "public_hostname": { "description": "Empty for private HTTP; otherwise pinned generated hostname", "type": "string" } }, "required": [ "public", "port", "public_hostname" ], "type": "object" }, "TupleHealth": { "additionalProperties": false, "properties": { "liveness_path": { "pattern": "^(/[^?#\\r\\n]*)?$", "type": "string" }, "readiness_path": { "pattern": "^(/[^?#\\r\\n]*)?$", "type": "string" } }, "required": [ "readiness_path", "liveness_path" ], "type": "object" }, "TupleIdentities": { "additionalProperties": false, "properties": { "cluster": { "minLength": 1, "type": "string" }, "configs": { "description": "Identity at each index corresponds to the config binding at that index; explicit empty array in issue 5", "items": { "minLength": 1, "type": "string" }, "type": "array", "uniqueItems": true }, "namespace": { "minLength": 1, "type": "string" }, "registry_tenant": { "type": "string" }, "revision_id": { "minLength": 1, "type": "string" }, "runtime_revision": { "minLength": 1, "type": "string" }, "secrets": { "description": "Identity at each index corresponds to the secret binding at that index; explicit empty array in issue 5", "items": { "minLength": 1, "type": "string" }, "type": "array", "uniqueItems": true }, "service": { "minLength": 1, "type": "string" }, "service_account": { "minLength": 1, "type": "string" } }, "required": [ "cluster", "namespace", "service", "service_account", "registry_tenant", "revision_id", "runtime_revision", "configs", "secrets" ], "type": "object" }, "TuplePolicy": { "additionalProperties": false, "description": "Fully resolved immutable policy. mvi-v1 resolves mvi-small to CPU 500m, memory 512Mi, ephemeral storage 1Gi, min/max scale 0/2, concurrency 1 and workload timeout 300 seconds. RuntimeClass is captured at creation, including explicit empty string; never reread process defaults on reconciliation. The action execution deadline is separate.", "properties": { "concurrency": { "minimum": 1, "type": "integer" }, "cpu": { "minLength": 1, "type": "string" }, "digest": { "$ref": "#/components/schemas/TupleDigest" }, "ephemeral_storage": { "minLength": 1, "type": "string" }, "max_scale": { "minimum": 0, "type": "integer" }, "memory": { "minLength": 1, "type": "string" }, "min_scale": { "minimum": 0, "type": "integer" }, "resource_class": { "minLength": 1, "type": "string" }, "runtime_class": { "type": "string" }, "timeout_seconds": { "minimum": 1, "type": "integer" }, "version": { "minLength": 1, "type": "string" } }, "required": [ "version", "digest", "resource_class", "cpu", "memory", "ephemeral_storage", "min_scale", "max_scale", "concurrency", "timeout_seconds", "runtime_class" ], "type": "object" }, "TupleReadiness": { "additionalProperties": false, "description": "Exact-revision internal tuple evidence. For a committed new version, revision identifiers match tuple identities and observed_at does not precede created_at. On rollback fresh activation readiness is represented in committed receipt deployment_evidence, not the owner output or historical tuple. Ordinary public HTTP requires route_ready after promotion and public_url equal to https:// plus the pinned hostname; lease-only private_endpoint evidence instead requires route_ready false and an empty public_url, and does not attest public delivery. Private HTTP has an empty public_url. Candidate-only traffic_pending permits pre-promotion readiness without route_ready and is not successful activation evidence.", "properties": { "dedicated_activation": { "$ref": "#/components/schemas/DedicatedActivationReadiness" }, "observed_at": { "$ref": "#/components/schemas/Timestamp" }, "private_endpoint": { "description": "Lease-only private endpoint observation; not public delivery or authority. Requires route_ready false and empty public_url; accepted only with a canonical lease candidate.", "type": "boolean" }, "public_url": { "type": "string" }, "ready": { "const": true, "type": "boolean" }, "revision_id": { "minLength": 1, "type": "string" }, "route_ready": { "type": "boolean" }, "runtime_revision": { "minLength": 1, "type": "string" }, "traffic_pending": { "type": "boolean" } }, "required": [ "ready", "revision_id", "runtime_revision", "route_ready", "public_url", "observed_at" ], "type": "object" }, "TupleSecretBinding": { "additionalProperties": false, "description": "Opaque reference only; never secret values, key names, ciphertext, nonce, wrapped keys or hashes derived from secret contents.", "properties": { "mode": { "description": "env uses env[].valueFrom.secretKeyRef; envFrom uses envFrom.secretRef to the immutable pinned Secret. Secret values are never container env literals.", "enum": [ "env", "envFrom" ], "type": "string" }, "version_id": { "pattern": "^sec_[a-f0-9]{48}$", "type": "string" } }, "required": [ "version_id", "mode" ], "type": "object" }, "VersionActivationOutput": { "additionalProperties": false, "description": "Owner-private DEPLOY_VERSION/ROLLBACK_VERSION execution output variant, not a public Explorer DTO. Only safe identifiers/status survive the owner projection; neither tuple nor activation_readiness is returned. Owner version reads expose tuple_digest; receipt deployment_evidence binds fresh committed readiness. A durable candidate is intent only, not a version, readiness or active pointer. Staging fences the expected committed activation and keeps incumbent traffic. The candidate is checked ready, then promoted and route/endpoint-verified before the atomic Badger version/activation/pointer commit. This allows bounded precommit route exposure, not distributed atomicity. Failure attempts compensation to the committed target under a fresh bounded context; compensation failure is ambiguous. Restart restores only the durable committed target, never an uncommitted candidate or mutable latest revision. Missing complete evidence fails closed.", "properties": { "deployment_id": { "$ref": "#/components/schemas/DeploymentID" }, "public_url": { "format": "uri", "type": "string" }, "ready": { "type": "boolean" }, "status": { "type": "string" } }, "type": "object" }, "VersionID": { "pattern": "^ver_[0-9a-f]{32}$", "type": "string" }, "WaitingResizeView": { "allOf": [ { "$ref": "#/components/schemas/ActionView" }, { "properties": { "action": { "properties": { "type": { "const": "RESIZE_LEASE" } } }, "receipts": { "contains": { "properties": { "final_status": { "const": "WAITING_EFFECTIVE_TIME" }, "kind": { "const": "WAITING_EFFECTIVE_TIME" }, "payment_status": { "const": "SETTLED" }, "status": { "const": "WAITING_EFFECTIVE_TIME" } }, "required": [ "kind", "status", "final_status", "payment_status", "action_digest", "usdc_amount", "payee" ] } }, "state": { "properties": { "payment_status": { "const": "SETTLED" }, "status": { "const": "WAITING_EFFECTIVE_TIME" } }, "required": [ "payment_amount", "payment_asset", "payment_pay_to" ] } }, "type": "object" } ], "description": "Action identity and digest must match the approved resize. State proves SETTLED with exact approved amount, asset and payee; a matching action-bound waiting receipt proves scheduling only. Missing or mismatched receipts are not valid waiting evidence." }, "WorkloadSecretMetadata": { "additionalProperties": false, "description": "Sole private response projection. No values, key names, ciphertext, nonces, wrapped keys, serialized Kubernetes Secret data or deterministic plaintext hashes. Expired, revoked, deleted and tampered versions cannot be resolved for use. Root custody is external to Badger and its PVC backup.", "properties": { "algorithm": { "enum": [ "AES-256-GCM/v1" ], "type": "string" }, "created_at": { "format": "date-time", "type": "string" }, "deleted_at": { "format": "date-time", "type": "string" }, "expires_at": { "format": "date-time", "type": "string" }, "id": { "pattern": "^sec_[a-f0-9]{48}$", "type": "string" }, "key_count": { "maximum": 64, "minimum": 0, "type": "integer" }, "owner_id": { "pattern": "^eip155:8453:0x[a-f0-9]{40}$", "type": "string" }, "revoked_at": { "format": "date-time", "type": "string" }, "root_key_id": { "description": "Non-secret operator root identifier.", "type": "string" }, "state": { "enum": [ "active", "expired", "revoked", "deleted" ], "type": "string" }, "supersedes": { "pattern": "^sec_[a-f0-9]{48}$", "type": "string" } }, "required": [ "id", "owner_id", "state", "algorithm", "root_key_id", "key_count", "created_at", "expires_at" ], "type": "object" }, "WorkloadSecretWrite": { "additionalProperties": false, "description": "Write-only input. Maximum JSON body 524288 bytes; 1-64 keys; each UTF-8 value at most 16384 bytes; combined key and value bytes at most 65536. Duplicate and unknown fields are rejected. At most 8 concurrent requests globally and 2 per owner, 30-second deadline; 1000 lifetime versions per owner including tombstones.", "properties": { "expires_at": { "description": "Required RFC3339 timestamp strictly in the future and no more than 365 days ahead.", "format": "date-time", "type": "string" }, "values": { "additionalProperties": { "maxLength": 16384, "type": "string", "writeOnly": true }, "maxProperties": 64, "minProperties": 1, "propertyNames": { "pattern": "^[A-Za-z_][A-Za-z0-9_]{0,63}$" }, "type": "object", "writeOnly": true } }, "required": [ "values", "expires_at" ], "type": "object" } } }, "info": { "description": "One cynderd process exposes signer-owned, x402-paid compute, deployment-version, wallet-enrollment, and artifact lifecycles (DEPLOY, DEPLOY_VERSION, ROLLBACK_VERSION, ENROLL_WALLET, INVOKE, DELETE, REGISTER_ARTIFACT, and RETAIN_ARTIFACT) backed by one Badger store and embedded OCI Distribution registry.", "title": "Cynder MVI Action API", "version": "1.0.0-mvi" }, "openapi": "3.1.0", "paths": { "/healthz": { "get": { "operationId": "health", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Health" } } }, "description": "Process is alive" } }, "summary": "Process liveness" } }, "/openapi.json": { "get": { "operationId": "openAPI", "responses": { "200": { "content": { "application/json": { "schema": { "type": "object" } } }, "description": "Canonical OpenAPI JSON" } }, "summary": "Read the canonical machine-readable OpenAPI contract" } }, "/readyz": { "get": { "operationId": "readiness", "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Ready" } } }, "description": "Process can accept actions" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Badger, recovery, and Kubernetes capability readiness" } }, "/v1/actions": { "post": { "operationId": "createAction", "parameters": [ { "$ref": "#/components/parameters/IdempotencyKey" }, { "$ref": "#/components/parameters/OptionalActionSignature" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/CreateActionRequest" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionView" } } }, "description": "Action prepared; payment has not yet been settled.", "headers": { "Idempotency-Replayed": { "schema": { "enum": [ "true" ], "type": "string" } }, "Location": { "schema": { "type": "string" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "EIP-191 action signature required. Sign the domain-bound digest in CYNDER-ACTION-DIGEST and retry.", "headers": { "CYNDER-ACTION-DIGEST": { "required": true, "schema": { "$ref": "#/components/schemas/Digest" } } } }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/RateLimitError" }, "500": { "$ref": "#/components/responses/Error" } }, "summary": "Prepare an immutable action" } }, "/v1/actions/{actionID}": { "get": { "operationId": "getAction", "parameters": [ { "$ref": "#/components/parameters/ActionID" }, { "$ref": "#/components/parameters/ActionSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionView" } } }, "description": "Action view" }, "404": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" } }, "summary": "Read an owner-authenticated action, state, and receipt stream" } }, "/v1/actions/{actionID}/execute": { "post": { "description": "RESIZE_LEASE accepts new payment only when ReadyResize prerequisites hold. Settled scheduling returns 202 WAITING_EFFECTIVE_TIME, not activation. Recovery invokes exact-boundary resize and succeeds only after activation; waiting consumes no generic retry attempts. Missing prerequisites fail before new payment. Durable SETTLING/SETTLEMENT_UNKNOWN permits reconciliation only, without resubmission even if the adapter is lost. Settled activation failure remains refund-pending until authoritative refund finality. The node-backed resize adapter is opt-in and requires installed enforcing prerequisites.", "operationId": "executeAction", "parameters": [ { "$ref": "#/components/parameters/ActionID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "$ref": "#/components/parameters/PaymentSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionView" } } }, "description": "Paid action completed or its persisted result was replayed.", "headers": { "Idempotency-Replayed": { "schema": { "enum": [ "true" ], "type": "string" } }, "PAYMENT-RESPONSE": { "schema": { "contentEncoding": "base64", "type": "string" } } } }, "202": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WaitingResizeView" } } }, "description": "Settled RESIZE_LEASE awaits its signed effective time; not activated or successful. Budget is spent. Read the existing action; never pay again." }, "400": { "$ref": "#/components/responses/Error" }, "402": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "x402 v2 payment required for this action type.", "headers": { "PAYMENT-REQUIRED": { "required": true, "schema": { "contentEncoding": "base64", "type": "string" } } } }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/RateLimitError" }, "500": { "$ref": "#/components/responses/Error" }, "502": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Settle the action-specific payment and execute the prepared action" } }, "/v1/actions/{actionID}/recover-registration": { "post": { "description": "Empty body; no PAYMENT-SIGNATURE, new quote, payment, or new action. Sign POST, this exact path, register_artifact, the original idempotency key and original action digest. Only a settled FAILED REGISTER_ARTIFACT with a canonical digest reference is eligible. The server verifies original payment binding, owner/tenant admission, complete current manifest and blob hashes, the exact artifact effect and all canonical refund operations/reservations before atomically admitting recovery. OWED or CONFIRMED refund blocks. Ordinary execute stays terminal on FAILED. A successful replay returns the same artifact and original payment; older receipts remain unchanged, with an appended recovery receipt referencing the failed receipt digest. Missing or ambiguous state fails closed. A 503 after admission may be nonterminal; read the original action before any further request.", "operationId": "recoverSettledRegistration", "parameters": [ { "$ref": "#/components/parameters/ActionID" }, { "$ref": "#/components/parameters/ActionSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionView" } } }, "description": "Original registration recovered or its persisted success replayed; state, refund, output and receipt chain are returned." }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/RateLimitError" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Owner-signed, signature-only recovery of the original settled failed immutable artifact registration" } }, "/v1/artifacts": { "post": { "description": "Accepts only REGISTER_ARTIFACT and RETAIN_ARTIFACT. Owner authentication, digest challenge, and idempotency semantics are identical to POST /v1/actions.", "operationId": "createArtifactAction", "parameters": [ { "$ref": "#/components/parameters/IdempotencyKey" }, { "$ref": "#/components/parameters/OptionalActionSignature" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ArtifactActionRequest" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ActionView" } } }, "description": "Artifact action prepared; payment has not yet been settled.", "headers": { "Idempotency-Replayed": { "schema": { "enum": [ "true" ], "type": "string" } }, "Location": { "schema": { "type": "string" } } } }, "400": { "$ref": "#/components/responses/Error" }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "EIP-191 action signature required. Sign the domain-bound digest in CYNDER-ACTION-DIGEST and retry.", "headers": { "CYNDER-ACTION-DIGEST": { "required": true, "schema": { "$ref": "#/components/schemas/Digest" } } } }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/RateLimitError" }, "500": { "$ref": "#/components/responses/Error" } }, "summary": "Prepare an immutable paid artifact registration or retention action" } }, "/v1/configs": { "description": "Free owner-private non-secret config metadata, separate from paid actions. All config routes require a route/origin-bound EIP-191 signature and matching signer address; no digest challenge or payment is issued. Sign the 32 decoded bytes of SHA-256 over the concatenated UTF-8 byte-length-prefixed parts (decimal length, colon, value): cynder-action-signing-v1, normalized control origin, uppercase method, exact path, CONFIG, idempotency key (empty for GET), lowercase unprefixed SHA-256 hex of the exact request body (empty bytes for GET). Origin normalization lowercases scheme/host and removes the root slash. Reject query parameters and encoded paths; GET must have no body or idempotency key. POST requires application/json and exactly one idempotency header. JSON rejects duplicate keys, unknown fields, nulls, invalid UTF-8 and trailing documents. Every handler response has Cache-Control private, no-store and Vary CYNDER-ACTION-SIGNATURE, CYNDER-CONFIG-ADDRESS. Config values, IDs and ownership never enter public Explorer/search/SSE. Config CRUD does not inject environment into workloads. DEPLOY selects immutable config references through configs bindings, never inline environment values. Create and retain, including exact replays, require ACTIVE wallet enrollment, x402 activation and deploy scope (403 otherwise). Reads and owned revocation do not require active enrollment. Ownership is checked before mutation replay. Store-wide lifetime limits are 256 versions and 1024 ordinary replay results. One active-to-revoked transition per existing version may exceed the ordinary replay limit, bounded by 1280 total results (ConfigMaxReplays+ConfigMaxVersions). New-key no-op revocations have no reserve. Exact replays consume no capacity.", "get": { "description": "Signer-owned reads do not require active enrollment. No pagination, query parameters, body, or Idempotency-Key. Ordered by opaque ID, not creation time. Bounded by the store-wide 256-version limit. The system legacy version is excluded.", "operationId": "listConfigs", "parameters": [ { "$ref": "#/components/parameters/ConfigSignature" }, { "$ref": "#/components/parameters/ConfigAddress" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ConfigList" } } }, "description": "Owner-private config list; empty list is configs [].", "headers": { "Cache-Control": { "schema": { "const": "private, no-store", "type": "string" } }, "Vary": { "schema": { "const": "CYNDER-ACTION-SIGNATURE, CYNDER-CONFIG-ADDRESS", "type": "string" } } } }, "400": { "$ref": "#/components/responses/ConfigInvalid" }, "401": { "$ref": "#/components/responses/ConfigUnauthorized" }, "413": { "$ref": "#/components/responses/ConfigTooLarge" }, "500": { "$ref": "#/components/responses/ConfigStoreError" } }, "summary": "List all of the signer's config versions, including revoked versions" }, "post": { "description": "Returns 201 for both creation and replay. Equivalent decoded maps have the same digest, but new keys create distinct opaque IDs. All config mutations share one owner-scoped idempotency namespace. Replay returns the original result snapshot, not current lifecycle state; GET reads current state. Requires ACTIVE enrollment with x402 activation and deploy scope, including replay (403 otherwise). New writes at the version or ordinary replay limit return 409 config_capacity; an admitted exact replay still succeeds.", "operationId": "createConfig", "parameters": [ { "$ref": "#/components/parameters/ConfigSignature" }, { "$ref": "#/components/parameters/ConfigAddress" }, { "$ref": "#/components/parameters/ConfigIdempotencyKey" } ], "requestBody": { "content": { "application/json": { "example": { "env": { "APP_MODE": "production", "LOG_LEVEL": "info" } }, "schema": { "$ref": "#/components/schemas/CreateConfigRequest" } } }, "required": true }, "responses": { "201": { "$ref": "#/components/responses/ConfigVersion" }, "400": { "$ref": "#/components/responses/ConfigInvalid" }, "401": { "$ref": "#/components/responses/ConfigUnauthorized" }, "403": { "$ref": "#/components/responses/ConfigAdmission" }, "409": { "$ref": "#/components/responses/ConfigConflict" }, "413": { "$ref": "#/components/responses/ConfigTooLarge" }, "415": { "$ref": "#/components/responses/ConfigMediaType" }, "500": { "$ref": "#/components/responses/ConfigStoreError" } }, "summary": "Create an immutable owner-private non-secret environment version" } }, "/v1/configs/{configID}": { "get": { "description": "Same signing contract as /v1/configs with this exact path. Signer-owned reads do not require active enrollment. No body, query parameters, encoded path, or Idempotency-Key. Cross-owner, invalid and unknown IDs return identical 404 envelopes. The system legacy version is not exposed by this route.", "operationId": "getConfig", "parameters": [ { "$ref": "#/components/parameters/ConfigID" }, { "$ref": "#/components/parameters/ConfigSignature" }, { "$ref": "#/components/parameters/ConfigAddress" } ], "responses": { "200": { "$ref": "#/components/responses/ConfigVersion" }, "400": { "$ref": "#/components/responses/ConfigInvalid" }, "401": { "$ref": "#/components/responses/ConfigUnauthorized" }, "404": { "$ref": "#/components/responses/ConfigNotFound" }, "413": { "$ref": "#/components/responses/ConfigTooLarge" }, "500": { "$ref": "#/components/responses/ConfigStoreError" } }, "summary": "Inspect the current owner-private config record" } }, "/v1/configs/{configID}/retain": { "post": { "description": "Same signing and strict request contract as /v1/configs with this exact path. Equal deadlines are allowed; shortening returns lifecycle_conflict. Retention can extend a revoked record but never reactivates it. Initial retain_until equals created_at. No expiry or automatic deletion is performed. Equivalent timestamp instants replay the same result for the same key. The reserved system legacy ID cannot be mutated (409). Requires ACTIVE enrollment with x402 activation and deploy scope, including exact replays (403 otherwise), after ownership is checked. New writes at the ordinary 1024-result limit return 409 config_capacity; admitted exact replays consume no capacity and still succeed.", "operationId": "retainConfig", "parameters": [ { "$ref": "#/components/parameters/ConfigID" }, { "$ref": "#/components/parameters/ConfigSignature" }, { "$ref": "#/components/parameters/ConfigAddress" }, { "$ref": "#/components/parameters/ConfigIdempotencyKey" } ], "requestBody": { "content": { "application/json": { "example": { "retain_until": "2030-01-01T00:00:00Z" }, "schema": { "$ref": "#/components/schemas/RetainConfigRequest" } } }, "required": true }, "responses": { "200": { "$ref": "#/components/responses/ConfigVersion" }, "400": { "$ref": "#/components/responses/ConfigInvalid" }, "401": { "$ref": "#/components/responses/ConfigUnauthorized" }, "403": { "$ref": "#/components/responses/ConfigAdmission" }, "404": { "$ref": "#/components/responses/ConfigNotFound" }, "409": { "$ref": "#/components/responses/ConfigConflict" }, "413": { "$ref": "#/components/responses/ConfigTooLarge" }, "415": { "$ref": "#/components/responses/ConfigMediaType" }, "500": { "$ref": "#/components/responses/ConfigStoreError" } }, "summary": "Extend a config retention deadline monotonically" } }, "/v1/configs/{configID}/revoke": { "post": { "description": "Same signing and strict request contract as /v1/configs with this exact path. Body must be {}. Repeated revocation preserves revoked_at, even with a fresh key. Replay returns the original result snapshot. Revocation blocks the store's ResolveConfig integration gate; it does not stop existing workloads. The reserved system legacy ID cannot be mutated (409). Owned revocation and its exact replay remain available without active wallet enrollment. ACL is checked first. An active-to-revoked transition can exceed the ordinary 1024-result limit once per existing version, with a hard total bound of 1280. New-key no-op revocations at capacity return 409 config_capacity; exact replay preserves the original snapshot and consumes no capacity.", "operationId": "revokeConfig", "parameters": [ { "$ref": "#/components/parameters/ConfigID" }, { "$ref": "#/components/parameters/ConfigSignature" }, { "$ref": "#/components/parameters/ConfigAddress" }, { "$ref": "#/components/parameters/ConfigIdempotencyKey" } ], "requestBody": { "content": { "application/json": { "example": {}, "schema": { "additionalProperties": false, "maxProperties": 0, "type": "object" } } }, "required": true }, "responses": { "200": { "$ref": "#/components/responses/ConfigVersion" }, "400": { "$ref": "#/components/responses/ConfigInvalid" }, "401": { "$ref": "#/components/responses/ConfigUnauthorized" }, "404": { "$ref": "#/components/responses/ConfigNotFound" }, "409": { "$ref": "#/components/responses/ConfigConflict" }, "413": { "$ref": "#/components/responses/ConfigTooLarge" }, "415": { "$ref": "#/components/responses/ConfigMediaType" }, "500": { "$ref": "#/components/responses/ConfigStoreError" } }, "summary": "Irreversibly revoke a config version without deleting its content" } }, "/v1/deployments/{deploymentID}": { "get": { "operationId": "getDeployment", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Deployment" } } }, "description": "Deployment projection" }, "404": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" } }, "summary": "Read the owner-authenticated durable deployment projection or tombstone" } }, "/v1/deployments/{deploymentID}/lease": { "get": { "description": "Owner read signature uses original DEPLOY action payment name deploy, original idempotency key and immutable digest, actual HTTP method/path and configured control origin. Missing/wrong owner returns 404. Cache-Control private, no-store; Vary CYNDER-ACTION-SIGNATURE. Never send PAYMENT-SIGNATURE. History is a bounded action-ID scan, not a complete payment ledger.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "description": "Opaque action-ID continuation from service_lease.history_next_cursor.", "in": "query", "name": "history_cursor", "required": false, "schema": { "pattern": "^act_[0-9a-f]{32}$", "type": "string" } }, { "in": "query", "name": "history_limit", "required": false, "schema": { "default": 20, "maximum": 50, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ServiceLeaseProjection" } } }, "description": "ServiceLeaseProjection" }, "400": { "$ref": "#/components/responses/Error", "description": "invalid_history_page for an invalid cursor or limit" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "not_found for ownership or missing deployment; resource_spec_not_found for legacy resource read" }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "lease_admission_disabled for disabled quotes; lease_store_unavailable for unavailable reads" } }, "security": [], "summary": "ServiceLeaseProjection" } }, "/v1/deployments/{deploymentID}/lease/policy": { "get": { "description": "Owner read signature uses original DEPLOY action payment name deploy, original idempotency key and immutable digest, actual HTTP method/path and configured control origin. Missing/wrong owner returns 404 before readiness evaluation. Cache-Control private, no-store; Vary CYNDER-ACTION-SIGNATURE. Never send PAYMENT-SIGNATURE. Owner-private capability discovery, not an enable switch, reservation, price quote or deployment/resource eligibility guarantee. Both enabled flags and ACQUIRE_LEASE/RENEW_LEASE follow LeaseCoordinator.Ready; RESIZE_LEASE additionally requires ReadyResize. A ready response has disabled_reason empty and pricing_policy equal to the actual validated operator snapshot (PascalCase keys). Disabled responses retain both flags false, disabled_reason lease_admission_not_configured_or_integrated, pricing_policy null and supported_paid_operations []. No defaults or prices are synthesized. Readiness is rechecked on each request; runtime readiness errors disable discovery without exposing private details. Per-request preflight rejects public HTTP combined with volumes, unsupported volume shapes, missing material or storage authority and stale/unavailable evidence before payment. A supported single volume requires installed paid-storage enforcement; resize does not accept volumes. Policy GET does not run preflight or reserve capacity. Daemon prerequisites are opt-in and require verified installed enforcement. Legacy policy remains LEAVE_UNCHANGED. Never automatically downgrade signing or pay from this response.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LeasePolicy" } } }, "description": "LeasePolicy" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "not_found for ownership or missing deployment; resource_spec_not_found for legacy resource read" }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "lease_admission_disabled for disabled quotes; lease_store_unavailable for unavailable reads" } }, "security": [], "summary": "LeasePolicy" } }, "/v1/deployments/{deploymentID}/lease/quotes": { "post": { "description": "Every readiness state requires strict JSON and Idempotency-Key; computes ResourceSpec ID first, then SHA256(cynder-lease-quote-request/v1 + newline + sorted-key JSON {Operation,Resource,Duration}), where Resource includes computed resource_spec_id. Outer cynder-action-signing-v1 uses action lease_quote, actual POST method/path, configured control origin, idempotency key and that body digest; EIP-191 signs outer digest. Missing/wrong owner returns 404. Invalid signature returns 401 with CYNDER-ACTION-DIGEST; no fallback to original DEPLOY read signing. Cache-Control private, no-store; Vary CYNDER-ACTION-SIGNATURE. Never send PAYMENT-SIGNATURE. After valid owner/body signature, unavailable admission returns 503 lease_admission_disabled without reservation/payment. A successful ready quote reserves capacity, but never submits payment. Policy read projects coordinator readiness; it is not a guarantee that this resource request passes preflight.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LeaseQuoteRequest" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/LeaseQuote" } } }, "description": "LeaseQuote (ready coordinator only; unavailable in current daemon)" }, "400": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "invalid_resource_spec, idempotency_key_required, invalid_quote or strict JSON failure" }, "401": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "action_signature_required; CYNDER-ACTION-DIGEST contains locally reproducible signing digest", "headers": { "CYNDER-ACTION-DIGEST": { "schema": { "$ref": "#/components/schemas/Digest" } } } }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "not_found for ownership or missing deployment; resource_spec_not_found for legacy resource read" }, "409": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "lease_admission_rejected" }, "415": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "unsupported_media_type" }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "lease_admission_disabled for disabled quotes; lease_store_unavailable for unavailable reads" } }, "security": [], "summary": "LeaseQuote" } }, "/v1/deployments/{deploymentID}/resource-spec": { "get": { "description": "Owner read signature uses original DEPLOY action payment name deploy, original idempotency key and immutable digest, actual HTTP method/path and configured control origin. Missing/wrong owner returns 404. Cache-Control private, no-store; Vary CYNDER-ACTION-SIGNATURE. Never send PAYMENT-SIGNATURE.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ResourceSpec" } } }, "description": "ResourceSpec" }, "404": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "not_found for ownership or missing deployment; resource_spec_not_found for legacy resource read" }, "503": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/Error" } } }, "description": "lease_admission_disabled for disabled quotes; lease_store_unavailable for unavailable reads" } }, "security": [], "summary": "ResourceSpec" } }, "/v1/deployments/{deploymentID}/storage-authorities/{obligationID}": { "get": { "description": "Owner-private recorded funding readback only, not a purchase, provisioning, live CSI readiness, or retained-access claim. Sign the original DEPLOY action digest and idempotency key with action deploy, actual GET method and full request path, and configured control origin. Missing, foreign and unauthenticated resources return 404. No PAYMENT-SIGNATURE is required. Responses exclude custody identities, signatures and settlement evidence. Cache-Control is private, no-store; Vary CYNDER-ACTION-SIGNATURE.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "in": "path", "name": "obligationID", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "deployment_id": { "type": "string" }, "funding_state": { "enum": [ "FUNDED", "EXPIRED", "REVOKED" ], "type": "string" }, "obligation_id": { "type": "string" }, "paid_through": { "format": "uint64", "type": "integer" }, "retention": { "type": "string" }, "retention_deadline": { "format": "uint64", "type": "integer" }, "size_bytes": { "format": "uint64", "type": "integer" }, "status": { "enum": [ "RECORDED_AUTHORIZED", "UNKNOWN", "UNAVAILABLE" ], "type": "string" }, "tier": { "type": "string" }, "volume_id": { "type": "string" } }, "required": [ "obligation_id", "deployment_id", "volume_id", "size_bytes", "tier", "retention", "paid_through", "retention_deadline", "funding_state", "status" ], "type": "object" } } }, "description": "Explicit owner-safe recorded authority projection" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "security": [], "summary": "Read recorded storage funding authority" } }, "/v1/deployments/{deploymentID}/storage-authorities/{obligationID}/export": { "post": { "description": "Owner-private, unpaid, signed retained export. No PAYMENT-SIGNATURE or Idempotency-Key. Require application/json with exactly one expected_epoch unsigned uint64 greater than zero; reject duplicate or unknown fields, query parameters, and request bodies above 1 MiB. Compute lowercase SHA-256 hex of the exact raw body bytes prefixed by \"cynder-retained-export/v1\\n\"; sign with ActionSigningDigest action storage-export, POST, exact request path, configured control origin, empty idempotency key, and that digest. The EIP-191 CYNDER-ACTION-SIGNATURE must recover the deployment and obligation owner. Missing or foreign resources and invalid signatures return 404; malformed requests return 400. The explicitly configured immutable digest reader image and retained epoch CAS gate the effect; unavailable, canceled, failed, empty or oversized archives return 503 without any archive bytes. Success returns at most 1 MiB of application/x-tar bytes. Never cache or print the archive; Cache-Control is private, no-store and Vary is CYNDER-ACTION-SIGNATURE. No tar extraction is performed by this endpoint.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "in": "path", "name": "obligationID", "required": true, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "expected_epoch": { "format": "uint64", "minimum": 1, "type": "integer" } }, "required": [ "expected_epoch" ], "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/x-tar": { "schema": { "format": "binary", "maxLength": 1048576, "type": "string" } } }, "description": "Binary retained archive, no more than 1048576 bytes" }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "security": [], "summary": "Export a bounded retained storage archive to the owner" } }, "/v1/deployments/{deploymentID}/storage-authorities/{obligationID}/funding": { "get": { "description": "Sign the original DEPLOY action digest and idempotency key for this exact GET path and configured origin. The purchase_key query selects the original confirmed purchase. The server rechecks retained finality and current CSI custody. This response is a digest commitment only, not signing bytes: StorageFundingBytes includes private CSI identifiers, so a separately trusted owner-signing integration must review the full retained statement before signing. No raw binding, payment signature or settlement proof is returned. Cache-Control private, no-store; Vary CYNDER-ACTION-SIGNATURE.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "in": "path", "name": "obligationID", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "purchase_key", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "expires_at": { "format": "uint64", "type": "integer" }, "obligation_id": { "type": "string" }, "purchase_key": { "type": "string" }, "sequence": { "format": "uint64", "type": "integer" }, "signing_domain": { "enum": [ "cynder/storage/final-settlement/v1" ], "type": "string" }, "statement_digest": { "description": "Lowercase SHA-256 hex of StorageFundingBytes", "type": "string" } }, "required": [ "purchase_key", "obligation_id", "sequence", "statement_digest", "expires_at", "signing_domain" ], "type": "object" } } }, "description": "Safe commitment, not a signable statement" }, "404": { "$ref": "#/components/responses/Error" } }, "security": [], "summary": "Read an owner-private purchase funding commitment" }, "post": { "description": "Owner-private admission of an already FINAL independently verified storage payment, not purchase, settlement, provisioning or live CSI readiness. With purchase_key, body contains only owner_signature and operator_signature (base64 byte arrays); the server reloads the original purchase-bound exact derived statement and checks current custody and finality. Without purchase_key, the general funding route accepts the Go JSON representation of SignedStorageFunding including Statement. Both Ed25519 signatures cover StorageFundingBytes(Statement) in the storage final-settlement domain. The separate EIP-191 deploy action signature binds POST, the exact path and configured origin, the original deployment action idempotency key, and the lowercase SHA-256 hex of the JSON-marshaled decoded request body. The purchase selector is not part of the EIP-191 path signature; the server binds it to the original action and exact dual-signed statement. Trust keys and independent FINAL settlement evidence come only from server-side configured custody; request-supplied keys or compute receipts cannot establish finality. Production requires separately provisioned pinned keys and a trusted owner signer able to review private custody. Replaying identical finalized signed funding is idempotent; other conflicts are rejected. Missing or foreign ownership is concealed as 404. Cache-Control private, no-store; Vary CYNDER-ACTION-SIGNATURE. Never send PAYMENT-SIGNATURE.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "in": "path", "name": "obligationID", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "purchase_key", "required": false, "schema": { "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "oneOf": [ { "additionalProperties": false, "properties": { "operator_signature": { "format": "byte", "type": "string" }, "owner_signature": { "format": "byte", "type": "string" } }, "required": [ "owner_signature", "operator_signature" ], "type": "object" }, { "additionalProperties": false, "properties": { "OperatorSignature": { "format": "byte", "type": "string" }, "OwnerSignature": { "format": "byte", "type": "string" }, "Statement": { "description": "Go StorageFunding statement with obligation and immutable CSI binding", "type": "object" } }, "required": [ "Statement", "OwnerSignature", "OperatorSignature" ], "type": "object" } ] } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "funding_state": { "enum": [ "FUNDED" ], "type": "string" }, "obligation_id": { "type": "string" }, "sequence": { "format": "uint64", "type": "integer" } }, "required": [ "obligation_id", "sequence", "funding_state" ], "type": "object" } } }, "description": "Safe recorded funding projection (including exact replay)" }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "422": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "security": [], "summary": "Admit independently settled storage funding" } }, "/v1/deployments/{deploymentID}/storage-authorities/{obligationID}/purchases/{purchaseKey}/signing-material": { "get": { "description": "Sensitive owner-only signing operation. The exact path includes the purchase identity; no query selector is accepted. EIP-191 signs the original DEPLOY digest and idempotency key bound to GET, this exact path and configured control origin. Foreign owners and missing/changed finality or CSI custody receive 404. The response contains the exact retained typed StorageFunding statement (including private CSI identifiers), its StorageFundingBytes SHA-256 commitment and purchase key, but no signatures, payment authorization, finality proof or workload secrets. Never log or display it in general owner or public views. A trusted local signer must parse the statement, compare original approved quote, owner, payment, coverage, sequence and CSI custody commitment, recompute its domain digest, then sign StorageFundingBytes; no blind signing. Cache-Control private, no-store; Vary CYNDER-ACTION-SIGNATURE.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "in": "path", "name": "obligationID", "required": true, "schema": { "type": "string" } }, { "in": "path", "name": "purchaseKey", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "purchase_key": { "type": "string" }, "statement": { "additionalProperties": false, "description": "Exact Go StorageFunding; includes Obligation, Binding, Sequence, Nonce, SettlementID, Network, Asset, Amount, Payee and ExpiresAt.", "properties": { "Amount": { "type": "string" }, "Asset": { "type": "string" }, "Binding": { "description": "Private immutable CSI custody identifiers and resource versions", "type": "object" }, "ExpiresAt": { "format": "uint64", "type": "integer" }, "Network": { "type": "string" }, "Nonce": { "type": "string" }, "Obligation": { "description": "Exact owner/deployment/coverage storage obligation", "type": "object" }, "Payee": { "type": "string" }, "Sequence": { "format": "uint64", "type": "integer" }, "SettlementID": { "type": "string" } }, "required": [ "Obligation", "Binding", "Sequence", "Nonce", "SettlementID", "Network", "Asset", "Amount", "Payee", "ExpiresAt" ], "type": "object" }, "statement_digest": { "description": "Lowercase SHA-256 hex of StorageFundingBytes(statement)", "type": "string" } }, "required": [ "purchase_key", "statement", "statement_digest" ], "type": "object" } } }, "description": "Purpose-scoped private typed signing statement" }, "404": { "$ref": "#/components/responses/Error" } }, "security": [], "summary": "Read purpose-scoped private storage purchase signing material" } }, "/v1/deployments/{deploymentID}/storage/purchases": { "post": { "description": "Strict JSON and Idempotency-Key are required. The EIP-191 action storage_purchase_quote binds POST, exact path, configured origin, key, and Digest(cynder-storage-purchase-prepare/v1, decoded request fields). A valid owner of the deployment is required. Policy and immutable CSI custody are resolved only from an explicitly installed server provider; cynderd installs one only with protected operator configuration and paid-storage enforcement, otherwise returning 503 for new requests. Exact authenticated replay returns the original durable intent even after quote expiry or policy removal. No payment, hold, storage grant, or paid operation is executed by this preparation route. Never send PAYMENT-SIGNATURE.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "$ref": "#/components/parameters/IdempotencyKey" } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "coverage_ends": { "format": "uint64", "type": "integer" }, "coverage_starts": { "format": "uint64", "type": "integer" }, "expected_sequence": { "format": "uint64", "type": "integer" }, "obligation_id": { "type": "string" }, "retention_policy": { "type": "string" }, "size_bytes": { "format": "uint64", "type": "integer" }, "tier": { "type": "string" }, "volume_id": { "type": "string" } }, "required": [ "obligation_id", "volume_id", "tier", "retention_policy", "size_bytes", "expected_sequence", "coverage_starts", "coverage_ends" ], "type": "object" } } }, "required": true }, "responses": { "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StoragePurchaseView" } } }, "description": "Durable NOT_SUBMITTED owner-only storage quote projection" }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "security": [], "summary": "Prepare an independently priced storage purchase (unpaid)" } }, "/v1/deployments/{deploymentID}/storage/purchases/{purchaseKey}": { "get": { "description": "Owner read signature binds the original DEPLOY action identity and digest to GET, exact path and configured origin. Foreign deployment, missing key or another deployment's intent returns 404. Returns only itemized pricing, the typed quote with its authenticated request and reviewed policy (for offline digest validation), and public obligation details. Request.CustodyDigest is only a commitment; the private CSI binding, trusted keys, signatures and payment evidence are never returned.", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" }, { "in": "path", "name": "purchaseKey", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/StoragePurchaseView" } } }, "description": "Owner-only storage purchase projection" }, "404": { "$ref": "#/components/responses/Error" } }, "security": [], "summary": "Read an owner's durable storage purchase intent" } }, "/v1/deployments/{deploymentID}/versions": { "get": { "operationId": "listDeploymentVersions", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "$ref": "#/components/parameters/ActionSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeploymentVersionList" } } }, "description": "Deployment versions" }, "404": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error", "description": "store_error when deployment versions cannot be read" } }, "summary": "List immutable versions and the active version for an owned deployment" } }, "/v1/deployments/{deploymentID}/versions/{versionID}": { "get": { "operationId": "getDeploymentVersion", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "in": "path", "name": "versionID", "required": true, "schema": { "$ref": "#/components/schemas/VersionID" } }, { "$ref": "#/components/parameters/ActionSignature" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/DeploymentVersionView" } } }, "description": "Deployment version" }, "404": { "$ref": "#/components/responses/Error" } }, "summary": "Read one immutable deployment version" } }, "/v1/explorer/actions": { "get": { "description": "Public read-only projection. Public transaction, deployment, artifact, receipt, and settlement identifiers may be returned. Owner wallet addresses, tenant mappings, idempotency keys, raw payloads, payment authorization material, invocation input/output, private runtime details, and internal errors are never returned.", "operationId": "listPublicActions", "parameters": [ { "in": "query", "name": "limit", "required": false, "schema": { "default": 20, "maximum": 50, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicActionList" } } }, "description": "Recent public action summaries" }, "400": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "List recent sanitized public Cynder transaction summaries" } }, "/v1/explorer/actions/{actionID}": { "get": { "description": "Public read-only projection; this route intentionally does not use owner authentication.", "operationId": "getPublicAction", "parameters": [ { "$ref": "#/components/parameters/ActionID" } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicActionDetail" } } }, "description": "Redacted public action detail" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Read one redacted public action and timeline" } }, "/v1/explorer/artifacts": { "get": { "description": "Ordered by latest public REGISTER_ARTIFACT or RETAIN_ARTIFACT lifecycle activity, not artifact creation time. Never returns tenant, repository or tag, config or layer digests, registry endpoints, node IDs, locations, pin counts, or retention internals.", "operationId": "listPublicArtifacts", "parameters": [ { "in": "query", "name": "limit", "required": false, "schema": { "default": 20, "maximum": 50, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicArtifactList" } } }, "description": "Privacy-safe public artifact list" }, "400": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "List recent public artifact activity from settled terminal artifact lifecycle actions" } }, "/v1/explorer/artifacts/{artifactID}": { "get": { "description": "Malformed, private, and missing identifiers produce the same 404 response.", "operationId": "getPublicArtifact", "parameters": [ { "in": "path", "name": "artifactID", "required": true, "schema": { "$ref": "#/components/schemas/ArtifactID" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicArtifactSummary" } } }, "description": "Privacy-safe public artifact" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Read one privacy-safe public artifact" } }, "/v1/explorer/deployments": { "get": { "operationId": "listPublicDeployments", "parameters": [ { "in": "query", "name": "limit", "required": false, "schema": { "default": 20, "maximum": 50, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicDeploymentList" } } }, "description": "Recent public deployments" }, "400": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "List recent sanitized public deployments" } }, "/v1/explorer/deployments/{deploymentID}": { "get": { "operationId": "getPublicDeployment", "parameters": [ { "$ref": "#/components/parameters/DeploymentID" }, { "description": "Opaque continuation from service_lease.history_next_cursor. History is a bounded scan in canonical action-ID order, not a complete payment ledger.", "in": "query", "name": "history_cursor", "required": false, "schema": { "pattern": "^act_[0-9a-f]{32}$", "type": "string" } }, { "in": "query", "name": "history_limit", "required": false, "schema": { "default": 20, "maximum": 50, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/PublicDeploymentDetail" } } }, "description": "Public deployment detail" }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Read one sanitized public deployment with its changelog, versions, and transactions" } }, "/v1/explorer/search": { "get": { "description": "Resolves a Cynder transaction ID, Base settlement transaction hash, deployment ID, artifact ID, or receipt ID. Wallet lookup is disabled, including historical wallet indexes. The response includes only public identifiers and related Cynder transaction IDs.", "operationId": "searchPublicExplorer", "parameters": [ { "in": "query", "name": "q", "required": true, "schema": { "maxLength": 128, "minLength": 1, "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/ExplorerSearchResult" } } }, "description": "Exact explorer result" }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Resolve an exact public Cynder explorer identifier" } }, "/v1/explorer/stream": { "get": { "description": "Same-origin SSE stream. Every connection receives a complete authoritative snapshot immediately and after committed explorer-visible state changes. Reconnection converges by receiving a fresh snapshot; this endpoint does not claim durable event replay.", "operationId": "streamPublicExplorer", "parameters": [ { "description": "When set, stream the sanitized transaction detail and receipt timeline instead of the recent transaction list.", "in": "query", "name": "transaction_id", "required": false, "schema": { "$ref": "#/components/schemas/ActionID" } }, { "description": "When set, stream sanitized deployment detail instead of the complete explorer snapshot. Mutually exclusive with transaction_id.", "in": "query", "name": "deployment_id", "required": false, "schema": { "$ref": "#/components/schemas/DeploymentID" } } ], "responses": { "200": { "content": { "text/event-stream": { "schema": { "type": "string" } } }, "description": "Server-sent snapshot events with heartbeat comments" }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Stream authoritative public explorer snapshots" } }, "/v1/workload-secrets": { "get": { "description": "Sign workload-secret:list with an empty body and canonical sorted URL-encoded query. No Idempotency-Key. Raw query is at most 256 bytes. No plaintext read endpoint exists.", "operationId": "listWorkloadSecrets", "parameters": [ { "description": "EIP-191 signature bound to owner, operation, HTTP method, path, origin, idempotency key, exact body and raw query.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "type": "string" } }, { "in": "query", "name": "after", "schema": { "pattern": "^sec_[a-f0-9]{48}$", "type": "string" } }, { "in": "query", "name": "limit", "schema": { "default": 100, "maximum": 100, "minimum": 1, "type": "integer" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "additionalProperties": false, "properties": { "next_after": { "type": "string" }, "secrets": { "items": { "$ref": "#/components/schemas/WorkloadSecretMetadata" }, "type": "array" } }, "required": [ "secrets", "next_after" ], "type": "object" } } }, "description": "Owner-scoped metadata page; empty next_after ends pagination. Cache-Control is private, no-store." }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "List only the signer's safe lifecycle metadata" }, "post": { "description": "Owner-signed private custody API, not a paid action. Never send values through /v1/actions. Responses contain metadata only; no key names, values, ciphertext, nonces, wrapped keys, or plaintext hashes. Sign exact body bytes and canonical raw query using WorkloadSecretRequestDigest and ActionSigningDigest with action workload-secret:create. No digest challenge is returned. See docs/workload-secrets.md for the signing contract.", "operationId": "createWorkloadSecret", "parameters": [ { "description": "EIP-191 signature bound to owner, operation, HTTP method, path, origin, idempotency key, exact body and raw query.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "type": "string" } }, { "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "pattern": "^[A-Za-z0-9._-]{1,128}$", "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretWrite" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretMetadata" } } }, "description": "Metadata only; mutation replay returns the original result, not a fresh lifecycle read. Use GET for current state. Cache-Control is private, no-store." }, "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretMetadata" } } }, "description": "New immutable version; metadata only." }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "413": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Create an encrypted write-only workload-secret version" } }, "/v1/workload-secrets/{secretID}": { "delete": { "description": "Sign workload-secret:delete. Requires the exact empty JSON object body and an empty query. Historical backups may still contain encrypted material; deletion is not physical erasure of old snapshots.", "operationId": "deleteWorkloadSecret", "parameters": [ { "description": "EIP-191 signature bound to owner, operation, HTTP method, path, origin, idempotency key, exact body and raw query.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "type": "string" } }, { "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "pattern": "^[A-Za-z0-9._-]{1,128}$", "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "maxProperties": 0, "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretMetadata" } } }, "description": "Metadata only; mutation replay returns the original result, not a fresh lifecycle read. Use GET for current state. Cache-Control is private, no-store." }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "413": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Remove live encrypted material and preserve an audit tombstone" }, "get": { "description": "Sign workload-secret:get with empty body and query and no Idempotency-Key. Cross-owner and unknown IDs return 404.", "operationId": "getWorkloadSecret", "parameters": [ { "description": "EIP-191 signature bound to owner, operation, HTTP method, path, origin, idempotency key, exact body and raw query.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "type": "string" } } ], "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretMetadata" } } }, "description": "Metadata only; mutation replay returns the original result, not a fresh lifecycle read. Use GET for current state. Cache-Control is private, no-store." }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Read current metadata only, never secret material" }, "parameters": [ { "in": "path", "name": "secretID", "required": true, "schema": { "pattern": "^sec_[a-f0-9]{48}$", "type": "string" } } ] }, "/v1/workload-secrets/{secretID}/revoke": { "parameters": [ { "in": "path", "name": "secretID", "required": true, "schema": { "pattern": "^sec_[a-f0-9]{48}$", "type": "string" } } ], "post": { "description": "Sign workload-secret:revoke with empty JSON object body and empty query. Does not revoke the upstream credential or erase old backups.", "operationId": "revokeWorkloadSecret", "parameters": [ { "description": "EIP-191 signature bound to owner, operation, HTTP method, path, origin, idempotency key, exact body and raw query.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "type": "string" } }, { "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "pattern": "^[A-Za-z0-9._-]{1,128}$", "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "additionalProperties": false, "maxProperties": 0, "type": "object" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretMetadata" } } }, "description": "Metadata only; mutation replay returns the original result, not a fresh lifecycle read. Use GET for current state. Cache-Control is private, no-store." }, "400": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "413": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Irreversibly revoke use of a version while retaining encrypted audit state" } }, "/v1/workload-secrets/{secretID}/rotate": { "parameters": [ { "in": "path", "name": "secretID", "required": true, "schema": { "pattern": "^sec_[a-f0-9]{48}$", "type": "string" } } ], "post": { "description": "Sign workload-secret:rotate. Empty query. New random ID, data key and nonce; supersedes references the predecessor. Revoked, expired, deleted or tampered predecessors fail closed. Revoke the old version separately when safe. This does not rotate the operator root or materialize Kubernetes Secrets.", "operationId": "rotateWorkloadSecret", "parameters": [ { "description": "EIP-191 signature bound to owner, operation, HTTP method, path, origin, idempotency key, exact body and raw query.", "in": "header", "name": "CYNDER-ACTION-SIGNATURE", "required": true, "schema": { "type": "string" } }, { "in": "header", "name": "Idempotency-Key", "required": true, "schema": { "pattern": "^[A-Za-z0-9._-]{1,128}$", "type": "string" } } ], "requestBody": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretWrite" } } }, "required": true }, "responses": { "200": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretMetadata" } } }, "description": "Metadata only; mutation replay returns the original result, not a fresh lifecycle read. Use GET for current state. Cache-Control is private, no-store." }, "201": { "content": { "application/json": { "schema": { "$ref": "#/components/schemas/WorkloadSecretMetadata" } } }, "description": "New immutable version; metadata only." }, "400": { "$ref": "#/components/responses/Error" }, "401": { "$ref": "#/components/responses/Error" }, "404": { "$ref": "#/components/responses/Error" }, "409": { "$ref": "#/components/responses/Error" }, "413": { "$ref": "#/components/responses/Error" }, "415": { "$ref": "#/components/responses/Error" }, "429": { "$ref": "#/components/responses/Error" }, "500": { "$ref": "#/components/responses/Error" }, "503": { "$ref": "#/components/responses/Error" } }, "summary": "Create a successor without rewriting or revoking the predecessor" } } }, "servers": [ { "url": "http://127.0.0.1:8080" } ] }