feat: seed SourceOS build substrate (schemas, examples, IaC + pipeline skeletons)

.github/workflows/validate.yml

@@ -0,0 +1,16 @@
+name: validate
+on:
+  push:
+  pull_request:
+jobs:
+  validate:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.12"
+      - name: Install strict-validation deps
+        run: pip install jsonschema
+      - name: make validate
+        run: make validate

.gitignore

@@ -0,0 +1,6 @@
+__pycache__/
+*.py[cod]
+.terraform/
+*.tfstate
+*.tfstate.*
+.env

Makefile

@@ -0,0 +1,4 @@
+.PHONY: validate
+
+validate:
+	python3 tools/validate_examples.py

README.md

@@ -0,0 +1,38 @@
+# sourceos-build
+
+Canonical **SourceOS build substrate**: infrastructure-as-code, build orchestration
+(Tekton / Argo CD), typed `BuildRequest` / `BuildReceipt` schemas, and artifact build
+receipts for the SourceOS / SociOS estate.
+
+## Boundary (what this repo is — and is not)
+
+**Ships:** IaC skeletons (Terraform, Ansible), CD/pipeline skeletons (Argo CD, Tekton),
+JSON Schemas for build requests and receipts, example payloads, and a local schema
+validation target.
+
+**Does NOT ship:** product or runtime application code, model weights, datasets, secrets,
+registry credentials, or Foreman/Katello credentials. This is not a `sourceos-platform`
+monorepo and does not absorb `agentplane`, `workstation-contracts`, or `socios`
+responsibilities. `socios` remains the opt-in automation/orchestration commons that
+*drives* this substrate.
+
+## Layout
+
+| Path | Purpose |
+|------|---------|
+| `schemas/sourceos/` | `build-request.v0.1` and `build-receipt.v0.1` JSON Schemas |
+| `examples/` | Example `BuildRequest` / `BuildReceipt` payloads (validate against the schemas) |
+| `terraform/` | Terraform skeleton (build infra) |
+| `ansible/` | Ansible skeleton (build host config) |
+| `argocd/` | Argo CD Application skeleton |
+| `tekton/` | Tekton pipeline + task skeleton |
+| `tools/validate_examples.py` | Validates the example payloads against the schemas |
+| `docs/adr/` | Architecture decision records |
+
+## Validate
+
+```
+make validate
+```
+
+Offline, deterministic; no network or credentials required.

ansible/README.md

@@ -0,0 +1,3 @@
+# ansible/
+
+Ansible skeleton for configuring SourceOS build hosts. Skeleton only — no inventory secrets, no vault contents committed.

ansible/inventory.example.ini

@@ -0,0 +1,2 @@
+[build]
+# build-host-1 ansible_host=REPLACE_ME

ansible/playbook.yml

@@ -0,0 +1,9 @@
+---
+# SourceOS build host configuration — skeleton (no secrets).
+- name: Configure SourceOS build host
+  hosts: build
+  become: true
+  tasks:
+    - name: Placeholder — install build toolchain
+      ansible.builtin.debug:
+        msg: "Skeleton task; real roles wired per environment."

argocd/application.yaml

@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sourceos-build
+  namespace: argocd
+spec:
+  project: default
+  source:
+    repoURL: https://github.com/SociOS-Linux/sourceos-build
+    targetRevision: main
+    path: tekton
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sourceos-build
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: false

docs/adr/ADR-0001-sourceos-build-substrate.md

@@ -0,0 +1,32 @@
+# ADR-0001: SourceOS build substrate as a dedicated repository
+
+- Status: Accepted
+- Date: 2026-07-04
+
+## Context
+
+SourceOS risked becoming a monolithic platform repository. Build orchestration, IaC,
+and artifact provenance were being scattered into product repositories and into `socios`.
+
+## Decision
+
+Create `SociOS-Linux/sourceos-build` as the canonical build substrate. It holds:
+
+- IaC (Terraform, Ansible) for build infrastructure;
+- build orchestration (Tekton pipelines, Argo CD applications);
+- typed `BuildRequest` / `BuildReceipt` schemas and example payloads;
+- artifact build receipts (provenance + digests).
+
+`socios` remains the opt-in automation/orchestration commons that *drives* this substrate
+by emitting `BuildRequest` documents and consuming `BuildReceipt` documents.
+
+## Consequences
+
+- Clear separation: substrate (this repo) vs. orchestration commons (`socios`) vs. product/runtime.
+- Downstream consumers depend on stable schema paths (`schemas/sourceos/*.schema.json`).
+- No secrets, credentials, weights, or datasets are committed here.
+
+## Non-goals
+
+- Recreating a `sourceos-platform` monorepo.
+- Moving `agentplane`, `workstation-contracts`, or `socios` responsibilities into this repo.

examples/build-receipt.example.json

@@ -0,0 +1,27 @@
+{
+  "schemaVersion": "build-receipt.v0.1",
+  "buildId": "build.sourceos-smoke-runner.0001",
+  "requestRef": "req.socios.sourceos-smoke-runner.2026-07-04",
+  "status": "succeeded",
+  "artifacts": [
+    {
+      "name": "sourceos-smoke-runner",
+      "type": "container-image",
+      "digest": "sha256:0000000000000000000000000000000000000000000000000000000000000000",
+      "ref": "registry.example/sourceos/smoke-runner@sha256:0000000000000000000000000000000000000000000000000000000000000000"
+    }
+  ],
+  "provenance": {
+    "builder": "tekton://sourceos-build/pipeline-build-image",
+    "sourceCommit": "0000000000000000000000000000000000000000",
+    "slsaLevel": 1
+  },
+  "signatures": [
+    {
+      "keyId": "sourceos-build-signing-v0",
+      "algorithm": "ed25519",
+      "value": "<base64-signature-placeholder>"
+    }
+  ],
+  "completedAt": "2026-07-04T00:05:00Z"
+}

examples/build-request.example.json

@@ -0,0 +1,24 @@
+{
+  "schemaVersion": "build-request.v0.1",
+  "requestId": "req.socios.sourceos-smoke-runner.2026-07-04",
+  "requestedBy": "SociOS-Linux/socios",
+  "source": {
+    "repository": "SociOS-Linux/socios",
+    "ref": "refs/heads/main",
+    "commit": "0000000000000000000000000000000000000000"
+  },
+  "target": {
+    "artifactType": "container-image",
+    "platform": "linux/amd64",
+    "outputRef": "registry.example/sourceos/smoke-runner"
+  },
+  "buildConfig": {
+    "contextPath": "images/sourceos-smoke-runner"
+  },
+  "evidenceRequirements": {
+    "digestRequired": true,
+    "provenanceRequired": true,
+    "signatureRequired": true
+  },
+  "createdAt": "2026-07-04T00:00:00Z"
+}

schemas/sourceos/build-receipt.v0.1.schema.json

@@ -0,0 +1,117 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.socioprophet.org/sourceos-build/build-receipt.v0.1.json",
+  "title": "SourceOS BuildReceipt",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "buildId",
+    "requestRef",
+    "status",
+    "artifacts",
+    "provenance"
+  ],
+  "properties": {
+    "schemaVersion": {
+      "type": "string",
+      "const": "build-receipt.v0.1"
+    },
+    "buildId": {
+      "type": "string",
+      "pattern": "^[a-z0-9][a-z0-9_.:-]+$"
+    },
+    "requestRef": {
+      "type": "string",
+      "description": "requestId of the BuildRequest this fulfills"
+    },
+    "status": {
+      "type": "string",
+      "enum": [
+        "succeeded",
+        "failed",
+        "rejected"
+      ]
+    },
+    "artifacts": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "name",
+          "type",
+          "digest"
+        ],
+        "properties": {
+          "name": {
+            "type": "string"
+          },
+          "type": {
+            "type": "string",
+            "enum": [
+              "container-image",
+              "iso",
+              "package",
+              "tarball"
+            ]
+          },
+          "digest": {
+            "type": "string",
+            "pattern": "^sha256:[a-f0-9]{64}$"
+          },
+          "ref": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "provenance": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": [
+        "builder",
+        "sourceCommit"
+      ],
+      "properties": {
+        "builder": {
+          "type": "string"
+        },
+        "sourceCommit": {
+          "type": "string"
+        },
+        "slsaLevel": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 4
+        }
+      }
+    },
+    "signatures": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": [
+          "keyId",
+          "algorithm",
+          "value"
+        ],
+        "properties": {
+          "keyId": {
+            "type": "string"
+          },
+          "algorithm": {
+            "type": "string"
+          },
+          "value": {
+            "type": "string"
+          }
+        }
+      }
+    },
+    "completedAt": {
+      "type": "string"
+    }
+  }
+}