Agent-driven build runs
Open a run against a source ref in a declared change class; its effective autonomy wave is the lesser of the program wave and the class ceiling (FAC07/08).
POST /api/v1/runsSS-31 · Tekton + Chains + Fleet
Hermetic builds with waved agent autonomy.
What it does
The sovereign build rail underneath SkyForge. A build run moves through source → built → gating → merged; builds fail closed on any non-hermetic dependency, provenance is signed, and the merge decision requires unanimous green gates. Self-approval is impossible by construction — the approver identity comes from edge-stamped headers, never a body field (FAC09).
In-mesh base http://ss-31-factory.shared-services.svc.cluster.local:8031 · auth is an SS-01 bearer token + X-Tenant-Id on every /api/v1 route.
Sub-capabilities
Open a run against a source ref in a declared change class; its effective autonomy wave is the lesser of the program wave and the class ceiling (FAC07/08).
POST /api/v1/runsFails closed the moment a dependency isn't served from the SS-04 proxy-cache — a direct fetch is a supply-chain violation, not a transient error. Identical inputs yield an identical digest.
POST /api/v1/runs/{id}/buildAttach a signed attestation to a built run; a run with no signed attestation can never merge (ErrUnsigned).
POST /api/v1/runs/{id}/attestRecord droplet/coderabbit/snyk verdicts; the decision auto-merges a governed class on unanimous green, else requires a human approval.
POST /api/v1/runs/{id}/decideEach class carries an autonomy ceiling and frozen state; misclassification is audit-recorded and rejected so a run can't be driven more permissively than its true content.
GET /api/v1/classesWorked example
The governed merge path. The build fails closed on any dependency not served from the SS-04 proxy-cache, and no run merges unsigned.
/api/v1/runs{product, class}. An unknown class 404s, a frozen class 409s.
/api/v1/runs/{id}/buildEvery dep must be from_cache: true, else the build aborts with no retry.
/api/v1/runs/{id}/attestSigned attestation derived from the reproducible digest.
/api/v1/runs/{id}/gatesdroplet / coderabbit / snyk → green.
/api/v1/runs/{id}/decideGoverned class + all green auto-merges; else 409 ErrNeedApproval.
Endpoint catalog
Real method + path from services/factory/openapi.json. The full contract, including ops endpoints, is the 13-operation surface.
/api/v1/runsidempotentOpen an agent-driven build run in a change class/api/v1/runsList runs with phase, class, wave and gate stack/api/v1/runs/{id}One run's full record incl. digest + attestation/api/v1/runs/{id}/buildidempotentRun the hermetic build (fails closed on non-cache dep)/api/v1/runs/{id}/attestAttach signed provenance (FAC03)/api/v1/runs/{id}/classifyValidate declared class vs actual diff (FAC07)/api/v1/runs/{id}/gatesRecord a gate-stack verdict (FAC10)/api/v1/runs/{id}/approveHuman merge approval (self-approval impossible, FAC09)/api/v1/runs/{id}/decideRun the merge decision on a signed, gated run/api/v1/runs/{id}/overrideT3 break-glass merge past a red gate (paged + audited)/api/v1/classesThe change-class taxonomy + autonomy ceilings/api/v1/classes/{class}/ceilingSet a class's autonomy ceiling (human-owned)/api/v1/classes/{class}/unfreezeUnfreeze a frozen class (audit-recorded)Architecture placement
CI/CD factory does not reimplement the platform — it composes it. These are the services it leans on and the seams between them.
The proxy-cache every hermetic build fetches through; a direct fetch fails the build closed.
The independent merge gate — one of the gate-stack verdicts the decision requires green.
Edge-stamped X-Subject / X-Agent-Identity drive approval; a body field never can.
Consumes the built, admitted image as the input to the deploy saga's admit step.
Signed run history and refusals are exported as compliance evidence.