2026-11-07 17:12:04 +00:00
11 changed files with 164 additions and 1 deletions
@@ -89,7 +89,16 @@
    "0pt.source_registry_list",
    "0pt.order_create",
    "0pt.order_payment",
-    "0pt.write_iceberg_table"
+    "0pt.write_iceberg_table",
+    "0pt.structure.resolve_entities",
+    "0pt.structure.get_lineage",
+    "0pt.structure.quality_run",
+    "0pt.structure.quality_list_runs",
+    "0pt.structure.quality_checks",
+    "0pt.structure.quality_reports",
+    "0pt.structure.extract_document",
+    "0pt.structure.route_parsing",
+    "0pt.structure.normalize_value"
  ],
  "surfaces": [
    "api",
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.extract_document",
+  "name": "0pt.structure.extract_document",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L2",
+  "piiLevel": "high",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.extract_document",
+  "description": "Canonical capability descriptor for 0pt.structure.extract_document (owner 0pt). Verified against registry + openapi operationId 0pt.extract_document."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.get_lineage",
+  "name": "0pt.structure.get_lineage",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.get_provenance",
+  "description": "Canonical capability descriptor for 0pt.structure.get_lineage (owner 0pt). Verified against registry + openapi operationId 0pt.get_provenance."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.normalize_value",
+  "name": "0pt.structure.normalize_value",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.normalize_value",
+  "description": "Canonical capability descriptor for 0pt.structure.normalize_value (owner 0pt). Verified against registry + openapi operationId 0pt.normalize_value."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_checks",
+  "name": "0pt.structure.quality_checks",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.checks",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_checks (owner 0pt). Verified against registry + openapi operationId 0pt.quality.checks."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_list_runs",
+  "name": "0pt.structure.quality_list_runs",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.list_runs",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_list_runs (owner 0pt). Verified against registry + openapi operationId 0pt.quality.list_runs."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_reports",
+  "name": "0pt.structure.quality_reports",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.reports",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_reports (owner 0pt). Verified against registry + openapi operationId 0pt.quality.reports."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.quality_run",
+  "name": "0pt.structure.quality_run",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.quality.run",
+  "description": "Canonical capability descriptor for 0pt.structure.quality_run (owner 0pt). Verified against registry + openapi operationId 0pt.quality.run."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.resolve_entities",
+  "name": "0pt.structure.resolve_entities",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L2",
+  "piiLevel": "high",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.resolve_entities",
+  "description": "Canonical capability descriptor for 0pt.structure.resolve_entities (owner 0pt). Verified against registry + openapi operationId 0pt.resolve_entities."
+}
@@ -0,0 +1,15 @@
+{
+  "id": "0pt.structure.route_parsing",
+  "name": "0pt.structure.route_parsing",
+  "owner": "0pt",
+  "version": "1.0.0",
+  "riskLevel": "L1",
+  "piiLevel": "low",
+  "surfaces": [
+    "api"
+  ],
+  "requiresJob": false,
+  "tenantScoped": true,
+  "operationId": "0pt.route_parsing",
+  "description": "Canonical capability descriptor for 0pt.structure.route_parsing (owner 0pt). Verified against registry + openapi operationId 0pt.route_parsing."
+}
@@ -0,0 +1,19 @@
+-- 023_canonical_grants.sql — app-role privileges for 022 canonical tables.
+--
+-- Tables created by a manual psql migration are owned by the migrating role
+-- (0pt_edge); the running application connects as 0pt_app. Existing 0pt tables
+-- carry explicit grants rather than default ACLs, so the canonical tables need
+-- the same treatment. RLS still applies to 0pt_app (FORCE is on); this only
+-- grants the statement privileges, not row visibility.
+--
+-- Idempotent and role-guarded: no-op in environments without the app role.
+
+DO $$
+BEGIN
+  IF EXISTS (SELECT 1 FROM pg_roles WHERE rolname = '0pt_app') THEN
+    GRANT SELECT, INSERT, UPDATE, DELETE
+      ON opt_canonical_entities, opt_canonical_facts, opt_canonical_relations
+      TO 0pt_app;
+  END IF;
+END
+$$;