From 021c345c47129267e82f40c7d0fa969f46e5a4b8 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Fri, 29 May 2026 12:41:55 -0400
Subject: [PATCH 1/2] Add workstation action boundary schema

---
 .../workstation-action-boundary.schema.json   | 58 +++++++++++++++++++
 1 file changed, 58 insertions(+)
 create mode 100644 profiles/linux-dev/workstation-v0/contracts/workstation-action-boundary.schema.json

diff --git a/profiles/linux-dev/workstation-v0/contracts/workstation-action-boundary.schema.json b/profiles/linux-dev/workstation-v0/contracts/workstation-action-boundary.schema.json
new file mode 100644
index 0000000..158f2f4
--- /dev/null
+++ b/profiles/linux-dev/workstation-v0/contracts/workstation-action-boundary.schema.json
@@ -0,0 +1,58 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://schemas.socios.dev/source-os/workstation-action-boundary.schema.json",
+  "title": "SourceOS Workstation Action Boundary",
+  "type": "object",
+  "additionalProperties": false,
+  "required": [
+    "schemaVersion",
+    "kind",
+    "boundaryId",
+    "artifactKind",
+    "profile",
+    "requestedAction",
+    "evidenceRefs",
+    "policyDecisionRefs",
+    "mutation",
+    "downstreamConsumers"
+  ],
+  "properties": {
+    "schemaVersion": { "const": "sourceos.workstation-action-boundary.v0.1" },
+    "kind": { "const": "WorkstationActionBoundary" },
+    "boundaryId": { "type": "string", "pattern": "^workstation-action-boundary:" },
+    "artifactKind": {
+      "type": "string",
+      "enum": ["doctor_report", "fix_plan", "admission_decision", "applied_fix", "post_fix_report"]
+    },
+    "profile": { "const": "linux-dev/workstation-v0" },
+    "requestedAction": { "type": "string", "minLength": 1 },
+    "evidenceRefs": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "policyDecisionRefs": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "mutation": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["planned", "performed", "performedBy", "beforeRefs", "afterRefs", "reversible", "rollbackRefs", "summary"],
+      "properties": {
+        "planned": { "type": "boolean" },
+        "performed": { "type": "boolean" },
+        "performedBy": { "type": ["string", "null"] },
+        "beforeRefs": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+        "afterRefs": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+        "reversible": { "type": "boolean" },
+        "rollbackRefs": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+        "summary": { "type": "string" }
+      }
+    },
+    "downstreamConsumers": { "type": "array", "items": { "type": "string" }, "uniqueItems": true },
+    "redaction": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["rawSensitiveDataIncluded", "redactedOnly"],
+      "properties": {
+        "rawSensitiveDataIncluded": { "const": false },
+        "redactedOnly": { "const": true }
+      }
+    },
+    "notes": { "type": "string" }
+  }
+}

From d7a14871d85138fa2d13e5b67c64a55919c33083 Mon Sep 17 00:00:00 2001
From: mdheller <21163552+mdheller@users.noreply.github.com>
Date: Fri, 29 May 2026 12:45:34 -0400
Subject: [PATCH 2/2] Add doctor workstation boundary fixture

---
 ...kstation-action-boundary.doctor.valid.json | 26 +++++++++++++++++++
 1 file changed, 26 insertions(+)
 create mode 100644 profiles/linux-dev/workstation-v0/examples/workstation-action-boundary.doctor.valid.json

diff --git a/profiles/linux-dev/workstation-v0/examples/workstation-action-boundary.doctor.valid.json b/profiles/linux-dev/workstation-v0/examples/workstation-action-boundary.doctor.valid.json
new file mode 100644
index 0000000..5c41579
--- /dev/null
+++ b/profiles/linux-dev/workstation-v0/examples/workstation-action-boundary.doctor.valid.json
@@ -0,0 +1,26 @@
+{
+  "schemaVersion": "sourceos.workstation-action-boundary.v0.1",
+  "kind": "WorkstationActionBoundary",
+  "boundaryId": "workstation-action-boundary:doctor-report-001",
+  "artifactKind": "doctor_report",
+  "profile": "linux-dev/workstation-v0",
+  "requestedAction": "sourceos doctor --json",
+  "evidenceRefs": ["evidence://sourceos/workstation/doctor-report-001"],
+  "policyDecisionRefs": [],
+  "mutation": {
+    "planned": false,
+    "performed": false,
+    "performedBy": null,
+    "beforeRefs": [],
+    "afterRefs": [],
+    "reversible": false,
+    "rollbackRefs": [],
+    "summary": "Doctor report is evidence/read path only."
+  },
+  "downstreamConsumers": ["agentplane", "sociosphere", "prophet-cli"],
+  "redaction": {
+    "rawSensitiveDataIncluded": false,
+    "redactedOnly": true
+  },
+  "notes": "Valid doctor report boundary: no mutation is planned or performed."
+}