Registry Coordinator configuration reference
Registry Coordinator reads three files: the workflow.yaml project you author, the
scenarios.yaml cases coordinatorctl test runs, and the runtime.yaml an operator deploys.
Contract status
Section titled “Contract status”| File | Kind | Status | Source |
|---|---|---|---|
workflow.yaml | CoordinatorProject | Pre-1.0, may change | project.schema.json |
scenarios.yaml | CoordinatorScenarios | Pre-1.0, may change | scenarios.schema.json |
runtime.yaml | CoordinatorRuntimeConfig | Pre-1.0, may change | runtime.schema.json |
JSON Schema is not the acceptance path: a document these schemas accept still has to pass
coordinatorctl check, which resolves operation aliases, mapping paths, step routes, and
completion references no schema can express
(Author a Coordinator workflow).
Three rules in runtime.yaml are written as exclusions the tables do not show. A policy under
deployment.authentication.policies whose actions are all deployment-wide (doctor,
restore-hold, release-restore-hold, release-admission-hold, complete-execution-recovery,
and retain) omits workflows, and every other policy sets it. On a type: scheduling
connection, observationAuthorization is required when authorization.taskAuthority is set and
omitted otherwise. On a type: external-http connection, authorization.taskAuthority is
refused. The project and scenarios schemas carry no such rule.
Key paths
Section titled “Key paths”A key path writes a property as name, an array item as name[], and a map entry whose name you
choose as name.*, as in workflow.steps.*.next or operations.*.uses.
workflow.yaml
Source preview, pre-1.0
Generated from products/coordinator/generated/project/project.schema.json. 165 key paths. Explained in docs/site/src/content/docs/reference/coordinator-configuration.mdx.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
apiVersionThe format and version this document is written in. | string | Yes |
| None specified |
contractsGenerated local public product contracts imported at compile time; no runtime discovery occurs. | object | No | Not specified | None specified |
contracts.*Map value | object | No | Not specified |
|
contracts.*.sourceA generated JSON artifact inside the project directory. | string | Yes | Not specified | None specified |
contracts.*.typeThe producer of this generated public contract artifact. | string | Yes |
| None specified |
descriptionAn optional explanation for readers; it has no execution or authorization effect. | string | No | Not specified | None specified |
functionsNamed typed bounded pure computations over one object of named inputs. | object | No | Not specified |
|
functions.*Map value | object | No | Not specified |
|
functions.*.descriptionAn optional explanation for readers; it has no execution or authorization effect. | string | No | Not specified | None specified |
functions.*.entrypointOne public source function taking exactly one named-input object. | string | Yes | Not specified | None specified |
functions.*.inputsNamed input schemas or references; every declared input is required exactly once. | object | Yes | Not specified |
|
functions.*.inputs.*Map valueA whole JSON Schema or one compile-time schema reference. Schema keywords
retain their independently owned JSON Schema spelling. | Not specified | No | Not specified |
|
functions.*.limitsOptional narrowing of the bounded pure profile; omitted limits retain the default ceiling. | object | No | Not specified | None specified |
functions.*.limits.arrayItemsMaximum array entries, from 1 to the 256-entry profile ceiling. | integer | No | Not specified |
|
functions.*.limits.callLevelsMaximum nested calls, from 1 to the 32-level profile ceiling. | integer | No | Not specified |
|
functions.*.limits.expressionDepthMaximum expression nesting, from 1 to the 64-level profile ceiling. | integer | No | Not specified |
|
functions.*.limits.mapEntriesMaximum object entries, from 1 to the 256-entry profile ceiling. | integer | No | Not specified |
|
functions.*.limits.operationsMaximum interpreter operations, from 1 to the 100000-operation profile ceiling. | integer | No | Not specified |
|
functions.*.limits.sourceBytesMaximum source bytes, from 1 to the 65536-byte profile ceiling. | integer | No | Not specified |
|
functions.*.limits.stringBytesMaximum string bytes, from 1 to the 16384-byte profile ceiling. | integer | No | Not specified |
|
functions.*.outputThe declared result schema or mapping; Functions and the host enforce it. | Not specified | Yes | Not specified | None specified |
functions.*.runtimeThe pinned pure runtime; rhai has no clock, network, database or credential capability. | string | Yes |
| None specified |
functions.*.sourceA local reviewed source asset inside the project directory. | string | Yes | Not specified | None specified |
functions.*.titleAn optional human title; it changes neither stable identity nor behavior revision. | string | No | Not specified | None specified |
kindThe kind of document this is. | string | Yes |
| None specified |
operationsLocal aliases for exact versioned host Operations and logical deployment connections. | object | No | Not specified |
|
operations.*Map value | object | No | Not specified |
|
operations.*.actionAn exact BReg Action specialization from one generated contract import. | object | No | Not specified | None specified |
operations.*.action.contractThe local generated contract import that owns this definition. | string | Yes | Not specified |
|
operations.*.action.idThe exact definition ID within that generated contract. | string | Yes | Not specified |
|
operations.*.completionsNamed bounded completion contracts; the host enforces their observation semantics. | object | No | Not specified | None specified |
operations.*.completions.*Map valueRepeats the accepted read under host-owned transport and credentials. | object | No | Not specified |
|
operations.*.completions.*.interpretThe typed pure Function that turns the saved command and response into an observation. | string | Yes | Not specified |
|
operations.*.completions.*.intervalSecondsSeconds between pending observations; the host may impose a stricter minimum. | integer | Yes | Not specified |
|
operations.*.completions.*.type | string | Yes |
| None specified |
operations.*.connectionThe logical deployment connection. It grants no authority. | string | Yes | Not specified |
|
operations.*.descriptionAn optional explanation for readers; it has no execution or authorization effect. | string | No | Not specified | None specified |
operations.*.responseSchemaAn optional typed response specialization for the bounded external GET Operation. | Not specified | No | Not specified | None specified |
operations.*.titleAn optional human title; it changes neither stable identity nor behavior revision. | string | No | Not specified | None specified |
operations.*.usesOne exact versioned host catalog contract. | string | Yes |
| None specified |
projectThe shared Project identity; its version is a human release label, not the computed Workflow revision. | object | Yes | Not specified | None specified |
project.idThe stable Workflow API name, also the enclosing Project ID. | string | Yes | Not specified |
|
project.versionThe human release label; it is distinct from the computed Workflow revision. | string | Yes | Not specified |
|
titleAn optional human title; it changes neither stable identity nor behavior revision. | string | No | Not specified | None specified |
typesReusable named JSON Schemas, referenced with typeRef in whole-schema positions. | object | No | Not specified |
|
types.*Map valueA whole JSON Schema or one compile-time schema reference. Schema keywords
retain their independently owned JSON Schema spelling. | Not specified | No | Not specified |
|
workflowThe one finite acyclic Workflow graph this project defines. | object | Yes | Not specified | None specified |
workflow.deadlineSecondsMaximum seconds from Run admission to expiry, from 1 to 31536000. | integer | Yes | Not specified |
|
workflow.eventTriggersOptional authenticated product-event starts keyed by stable trigger ID. | object | No | Not specified |
|
workflow.eventTriggers.*Map value | object | No | Not specified |
|
workflow.eventTriggers.*.dataSchemaExact producer data-schema identifier accepted by this trigger. | string | Yes | Not specified |
|
workflow.eventTriggers.*.eventSchema for the complete authenticated event envelope before input mapping. | Not specified | Yes | Not specified | None specified |
workflow.eventTriggers.*.eventTypeExact producer event type accepted by this trigger. | string | Yes | Not specified |
|
workflow.eventTriggers.*.inputOrdinary typed Mapping from the event envelope to Workflow start input. | object | Yes | Not specified | None specified |
workflow.eventTriggers.*.input.fieldsObject members built from typed references or literals. | object | Conditional | Not specified |
|
workflow.eventTriggers.*.input.fields.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.eventTriggers.*.input.fields.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.eventTriggers.*.input.fields.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.eventTriggers.*.input.fields.*.type | string | Conditional |
| None specified |
workflow.eventTriggers.*.input.fields.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.eventTriggers.*.input.functionA declared pure Function called with an object of named inputs. | string | Conditional | Not specified |
|
workflow.eventTriggers.*.input.inputsNamed input schemas or references; every declared input is required exactly once. | object | Conditional | Not specified |
|
workflow.eventTriggers.*.input.inputs.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.eventTriggers.*.input.inputs.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.eventTriggers.*.input.inputs.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.eventTriggers.*.input.inputs.*.type | string | Conditional |
| None specified |
workflow.eventTriggers.*.input.inputs.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.eventTriggers.*.input.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.eventTriggers.*.input.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.eventTriggers.*.input.type | string | Yes |
| None specified |
workflow.eventTriggers.*.input.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.eventTriggers.*.sourceLogical producer binding declared in runtime eventSources. | string | Yes | Not specified |
|
workflow.inputThe typed Workflow start input, or a mapping supplying the called Operation input. | Not specified | Yes | Not specified | None specified |
workflow.outcomesNamed terminal result schemas used by finish Steps. | object | Yes | Not specified |
|
workflow.outcomes.*Map valueA whole JSON Schema or one compile-time schema reference. Schema keywords
retain their independently owned JSON Schema spelling. | Not specified | No | Not specified |
|
workflow.startThe stable Step ID every Run begins at. | string | Yes | Not specified |
|
workflow.stepsSteps keyed by stable ID; map ordering has no execution meaning. | object | Yes | Not specified |
|
workflow.steps.*Map valueFor wait-until: Waits until a computed RFC 3339 instant. For wait-for: Observes one named completion of an earlier accepted call. For call: Calls one resolved Operation alias under the current connection authority. For choose: Selects one explicit graph edge by a typed case label. For finish: Finishes with one declared typed outcome. | object | No | Not specified |
|
workflow.steps.*.casesExplicit label-to-Step edges; no implicit fall-through exists. | object | Conditional | Not specified | None specified |
workflow.steps.*.cases.*Map valueA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -. | string | Conditional | Not specified |
|
workflow.steps.*.chooseA typed mapping producing one of the declared case labels. | object | Conditional | Not specified | None specified |
workflow.steps.*.choose.fieldsObject members built from typed references or literals. | object | Conditional | Not specified |
|
workflow.steps.*.choose.fields.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.choose.fields.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.choose.fields.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.choose.fields.*.type | string | Conditional |
| None specified |
workflow.steps.*.choose.fields.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.choose.functionA declared pure Function called with an object of named inputs. | string | Conditional | Not specified |
|
workflow.steps.*.choose.inputsNamed input schemas or references; every declared input is required exactly once. | object | Conditional | Not specified |
|
workflow.steps.*.choose.inputs.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.choose.inputs.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.choose.inputs.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.choose.inputs.*.type | string | Conditional |
| None specified |
workflow.steps.*.choose.inputs.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.choose.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.choose.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.choose.type | string | Conditional |
| None specified |
workflow.steps.*.choose.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.completionA preceding accepted call Step and one named Operation completion. | object | Conditional | Not specified | None specified |
workflow.steps.*.completion.nameOne named completion on the referenced call Operation. | string | Conditional | Not specified |
|
workflow.steps.*.completion.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.descriptionAn optional explanation for readers; it has no execution or authorization effect. | string | No | Not specified | None specified |
workflow.steps.*.inputThe typed Workflow start input, or a mapping supplying the called Operation input. | object | Conditional | Not specified | None specified |
workflow.steps.*.input.fieldsObject members built from typed references or literals. | object | Conditional | Not specified |
|
workflow.steps.*.input.fields.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.input.fields.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.input.fields.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.input.fields.*.type | string | Conditional |
| None specified |
workflow.steps.*.input.fields.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.input.functionA declared pure Function called with an object of named inputs. | string | Conditional | Not specified |
|
workflow.steps.*.input.inputsNamed input schemas or references; every declared input is required exactly once. | object | Conditional | Not specified |
|
workflow.steps.*.input.inputs.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.input.inputs.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.input.inputs.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.input.inputs.*.type | string | Conditional |
| None specified |
workflow.steps.*.input.inputs.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.input.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.input.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.input.type | string | Conditional |
| None specified |
workflow.steps.*.input.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.nextThe next Step on the successful completion route. | string | Conditional | Not specified |
|
workflow.steps.*.onCancelAn optional Step taken after authorized cancellation while waiting; no completion value is available there. | string | Conditional | Not specified |
|
workflow.steps.*.onDeclaredRefusalA separate Step taken only for a validated package-declared business refusal.
Omit it to fail the run with product-refused on a declared refusal too. | string | Conditional | Not specified |
|
workflow.steps.*.onTimeoutAn optional Step taken when this wait expires; no completion value is available there. | string | Conditional | Not specified |
|
workflow.steps.*.operationOne local Operation alias declared under operations. | string | Conditional | Not specified |
|
workflow.steps.*.outcomeOne declared terminal outcome name. | string | Conditional | Not specified |
|
workflow.steps.*.outputThe declared result schema or mapping; Functions and the host enforce it. | object | Conditional | Not specified | None specified |
workflow.steps.*.output.fieldsObject members built from typed references or literals. | object | Conditional | Not specified |
|
workflow.steps.*.output.fields.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.output.fields.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.output.fields.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.output.fields.*.type | string | Conditional |
| None specified |
workflow.steps.*.output.fields.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.output.functionA declared pure Function called with an object of named inputs. | string | Conditional | Not specified |
|
workflow.steps.*.output.inputsNamed input schemas or references; every declared input is required exactly once. | object | Conditional | Not specified |
|
workflow.steps.*.output.inputs.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.output.inputs.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.output.inputs.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.output.inputs.*.type | string | Conditional |
| None specified |
workflow.steps.*.output.inputs.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.output.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.output.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.output.type | string | Conditional |
| None specified |
workflow.steps.*.output.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.timeoutSecondsMaximum seconds to wait; it must be shorter than the Workflow deadline. | integer | Conditional | Not specified |
|
workflow.steps.*.titleAn optional human title; it changes neither stable identity nor behavior revision. | string | No | Not specified | None specified |
workflow.steps.*.type | string | Yes |
| None specified |
workflow.steps.*.waitUntilA mapping producing an RFC 3339 instant with an offset. | object | Conditional | Not specified | None specified |
workflow.steps.*.waitUntil.fieldsObject members built from typed references or literals. | object | Conditional | Not specified |
|
workflow.steps.*.waitUntil.fields.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.waitUntil.fields.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.waitUntil.fields.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.waitUntil.fields.*.type | string | Conditional |
| None specified |
workflow.steps.*.waitUntil.fields.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.waitUntil.functionA declared pure Function called with an object of named inputs. | string | Conditional | Not specified |
|
workflow.steps.*.waitUntil.inputsNamed input schemas or references; every declared input is required exactly once. | object | Conditional | Not specified |
|
workflow.steps.*.waitUntil.inputs.*Map valueFor input: Reads the Workflow input. For step: Reads an earlier accepted call or completed wait on every incoming route. For literal: Supplies one bounded literal JSON value. | object | Conditional | Not specified |
|
workflow.steps.*.waitUntil.inputs.*.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.waitUntil.inputs.*.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.waitUntil.inputs.*.type | string | Conditional |
| None specified |
workflow.steps.*.waitUntil.inputs.*.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
workflow.steps.*.waitUntil.pathAn optional RFC 6901 pointer; omit it to read the entire value. | string | Conditional | Not specified |
|
workflow.steps.*.waitUntil.stepThe preceding accepted call or completed wait Step whose value is read. | string | Conditional | Not specified |
|
workflow.steps.*.waitUntil.type | string | Conditional |
| None specified |
workflow.steps.*.waitUntil.valueA literal JSON value; it remains subject to bounded value checks. | Not specified | Conditional | Not specified | None specified |
scenarios.yaml
Source preview, pre-1.0
Generated from products/coordinator/generated/scenarios/scenarios.schema.json. 31 key paths. Explained in docs/site/src/content/docs/reference/coordinator-configuration.mdx.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
apiVersionThe format and version this document is written in. | string | Yes |
| None specified |
casesThe cases, 1 to 64, each with a unique id. | array | Yes | Not specified |
|
cases[]Array itemOne run of the workflow, from admission to where it stops. | object | No | Not specified | None specified |
cases[].admittedAtThe RFC 3339 instant the run is admitted; the virtual clock starts
here and moves only to the instants waits select. | string | Yes | Not specified |
|
cases[].expectWhere the run must stop. | object | Yes | Not specified | None specified |
cases[].expect.outcomeThe outcome the run finishes with, or {type: none} for a run that
finishes without one. Omit it to leave the outcome unchecked. | object | No | Not specified | None specified |
cases[].expect.outcome.type | string | Yes |
| None specified |
cases[].expect.outcome.valueThe outcome, declared under the workflow's outcomes. | string | Conditional | Not specified |
|
cases[].expect.outputThe output the run finishes with. Omit it to leave the output
unchecked. | Not specified | No | Not specifiedSchema default, where declared: null | None specified |
cases[].expect.pathThe steps the run reaches, in order. | array | Yes | Not specified |
|
cases[].expect.path[]Array itemA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -. | string | No | Not specified |
|
cases[].expect.stateThe state the run stops in. | string | Yes |
| None specified |
cases[].expect.workflowElapsedSecondsThe virtual seconds from admission to where the run stops. Omit it to
leave the time unchecked. | integer | No | Not specified |
|
cases[].idThe case name test reports. | string | Yes | Not specified |
|
cases[].inputThe start input, which must satisfy the workflow input schema. | Not specified | Yes | Not specified | None specified |
cases[].recoveryThe operator recovery each call step receives after a retryable or
uncertain reply, by step, so the step consumes its next reply. | object | No | Not specified |
|
cases[].recovery.*Map valueAn operator recovery: retry-same sends the same frozen command again
after a retryable reply, or after an uncertain one where the operation
allows it; reconcile reads the product's receipt for an uncertain
command, for operations that keep one. | string | No |
|
|
cases[].repliesThe synthetic replies each call step receives, by step, in the order
its attempts consume them: 1 to 8 per step. A reply after the first
needs a recovery for that step. | object | Yes | Not specified |
|
cases[].replies.*Map value | array | No | Not specified |
|
cases[].replies.*[]Array itemFor success: The call completed and returned value. For retryable: The call failed and may be retried; the run stops as retryable, or as
uncertain after an earlier uncertain reply, unless a recovery consumes
another reply. For refused: The product refused the call; the run stops as refused, or as
uncertain after an earlier uncertain reply. For declared-refusal: The product returned a package-declared, no-effect business refusal.
A supported call takes its onDeclaredRefusal edge when it has one;
otherwise the run stops as refused. For uncertain: The call's effect is unknown; the run stops as uncertain unless a
recovery consumes another reply. For receipt-expired: The product's receipt for the call expired, so the original command
cannot be confirmed; the run stops as uncertain and no later reply is
consumed. | object | No | Not specified | None specified |
cases[].replies.*[].codeFor retryable: The code the reply carries, such as credential-unavailable. For refused: The code the reply carries, such as product-not-found. For uncertain: The code the reply carries, such as transport-uncertain. | string | Conditional | Not specified |
|
cases[].replies.*[].refusalCodeThe validated refusal code the package declares. | string | Conditional | Not specified |
|
cases[].replies.*[].type | string | Yes |
| None specified |
cases[].replies.*[].valueThe output the call returns, which must satisfy the operation's
output contract. | Not specified | Conditional | Not specified | None specified |
cases[].waitsWhat each wait-for step the run reaches receives, by step: the event
it waits for, or its timeout. | object | No | Not specified |
|
cases[].waits.*Map valueFor event: The event arrives when the wait starts; the run continues at the
step's next with value as the step's output. For observations: The host repeats the accepted external read and interprets these
synthetic typed responses under the completion's named Function. For timeout: No event arrives: the clock moves by the step's timeoutSeconds, and
the run continues at its onTimeout, or stops as timed-out when the
step has none. A deadline that passes first stops the run as
deadline-exceeded. For cancel: An authorized caller cancels the run while this wait is durably
parked. The run continues at onCancel, or stops as cancelled when
the step has none. | object | No | Not specified |
|
cases[].waits.*.responsesOne to 128 bounded response objects in observation order. | array | Conditional | Not specified |
|
cases[].waits.*.responses[]Array item | Not specified | Conditional | Not specified | None specified |
cases[].waits.*.type | string | Yes |
| None specified |
cases[].waits.*.valueThe event, which must satisfy the step's event contract. A review
result must also be one the review protocol accepts, for the
request identifier, subject, policy and submission digest the
request step accepted. | Not specified | Conditional | Not specified | None specified |
kindThe kind of document this is. | string | Yes |
| None specified |
runtime.yaml
Source preview, pre-1.0
Generated from products/coordinator/generated/runtime/runtime.schema.json. 110 key paths. Explained in docs/site/src/content/docs/reference/coordinator-configuration.mdx.
| Key path | Type | Required | Accepted values | Constraints |
|---|---|---|---|---|
apiVersion | string | Yes |
| None specified |
connectionsNamed deployment bindings with one explicit type per connection. | object | Yes | Not specified |
|
connections.*Map valueOne logical connection namespace. The discriminator selects its complete
deployment contract; a connection cannot borrow another variant's authority. | object | No | Not specified |
|
connections.*.attemptTimeoutMilliseconds | integer | Conditional | Not specifiedSchema default, where declared: 2000 or 8000 |
or
|
connections.*.authorizationOmission makes the configured read public; it never inherits a caller token. | object | Conditional | Not specified | None specified |
connections.*.authorization.bearer | object | Conditional | Not specified | None specified |
connections.*.authorization.bearer.principalAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.bearer.tokenRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared. | string | Conditional | Not specified |
|
connections.*.authorization.clientAssertionAudienceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.clientIdAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.local | object | Conditional | Not specified | None specified |
connections.*.authorization.resourceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.scopes | array | Conditional | Not specified |
|
connections.*.authorization.scopes[]Array itemAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.signingKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared. | string | Conditional | Not specified |
|
connections.*.authorization.taskAuthority | object | Conditional | Not specified | None specified |
connections.*.authorization.taskAuthority.baseUrlAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted. | string | Conditional | Not specified |
|
connections.*.authorization.taskAuthority.bootstrapResourceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.taskAuthority.exchangeAudienceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.taskAuthority.issuerAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.taskAuthority.subjectAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.authorization.tokenEndpointAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted. | string | Conditional | Not specified |
|
connections.*.baseUrlAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted. | string | Yes | Not specified |
or
|
connections.*.completionAuthenticated minimized wake-ups; omission uses polling only. | object | Conditional | Not specified | None specified |
connections.*.completion.bearerTokenRefThe bearer token Casework's completion destination sends. | string | Conditional | Not specified |
|
connections.*.completion.recipientBindingThe recipientBinding the Casework project names for this producer's
completion destination: 1 to 256 printable ASCII characters without
spaces. Casework sends it in the registry-recipient-binding header. | string | Conditional | Not specified |
|
connections.*.maximumRequestBytes | integer | Conditional | Not specifiedSchema default, where declared: 65536 |
|
connections.*.maximumResponseBytes | integer | Conditional | Not specifiedSchema default, where declared: 65536 |
|
connections.*.modelAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorizationOrdinary receipt reads under the original owner, without taskAuthority. | object | Conditional | Not specified | None specified |
connections.*.observationAuthorization.clientAssertionAudienceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.clientIdAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.resourceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.scopes | array | Conditional | Not specified |
|
connections.*.observationAuthorization.scopes[]Array itemAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.signingKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.taskAuthority | object | Conditional | Not specified | None specified |
connections.*.observationAuthorization.taskAuthority.baseUrlAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.taskAuthority.bootstrapResourceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.taskAuthority.exchangeAudienceAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.taskAuthority.issuerAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.taskAuthority.subjectAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.observationAuthorization.tokenEndpointAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted. | string | Conditional | Not specified |
|
connections.*.paths | array | Conditional | Not specified |
|
connections.*.paths[]Array itemAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.producerA local identifier: a lowercase letter, then up to 63 lowercase letters, digits, _, or -. | string | Conditional | Not specified |
|
connections.*.profileAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.protocol | string | Conditional |
| None specified |
connections.*.queryParametersOmission permits no query parameters. | array | Conditional | Not specified |
|
connections.*.queryParameters[]Array itemAn identifier another system issues, written exactly as its issuer gives it. | string | Conditional | Not specified |
|
connections.*.responseSchemaLocal JSON Schema for the complete {status, body} response. | Not specified | Conditional | Not specified | None specified |
connections.*.resultCheckSeconds | integer | Conditional | Not specifiedSchema default, where declared: 900 |
|
connections.*.type | string | Yes |
| None specified |
databaseThe PostgreSQL connection a stateful runtime uses. Both URLs are secret
references and may name the same secret. | object | Yes | Not specified | None specified |
database.migrationUrlRefSecret reference to the migration connection URL. | string | Yes | Not specified |
|
database.runtimeUrlRefSecret reference to the least-privileged runtime connection URL. | string | Yes | Not specified |
|
database.testOnlyPlaintextAllow a plaintext connection. Refused outside test builds. | boolean | No |
false | None specified |
database.trustedRootCertificateRefSecret reference to a PEM root certificate the connection trusts.
Absent, the connection trusts the platform's root certificates. | string | No | Not specified |
|
deployment | object | No | Not specified | None specified |
deployment.activeStateKey | integer | Yes | Not specified |
|
deployment.admissionKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared. | string | Yes | Not specified |
|
deployment.auditFile | string | Yes | Not specified |
|
deployment.auditKeyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared. | string | Yes | Not specified |
|
deployment.authenticationThe OIDC issuer a runtime accepts access tokens from: the exact iss
value, the aud value a token must carry, and where the issuer's signing
keys come from, written under authentication.oidc beside the product's
own token rules. | object | Yes | Not specified | None specified |
deployment.authentication.allowInsecureHttpPermit plain HTTP beyond loopback to the configured issuer and to a
JWKS URI declared in configuration. TLS remains required unless the
operator explicitly accepts this transport risk. | boolean | No | Not specifiedSchema default, where declared: false | None specified |
deployment.authentication.assertionIssuersAssertion authorities each client may exchange a subject token from,
keyed by client identifier. Omitted, no assertion-issuer rule applies;
written, it lists at least one client, each with at least one
authority. Once a client is listed, a token it exchanged is accepted
only for one of that client's declared authorities, and a client that
is not listed may exchange from no authority. | object | No | Not specified |
|
deployment.authentication.assertionIssuers.*Map value | array | No | Not specified |
|
deployment.authentication.assertionIssuers.*[]Array item | string | No | Not specified |
|
deployment.authentication.audienceThe audience every accepted access token must carry in aud. | string | Yes | Not specified |
|
deployment.authentication.issuerExact issuer accepted in access-token iss claims, an absolute
https URL, or a plain http URL when allowInsecureHttp is set. | string | Yes | Not specified |
|
deployment.authentication.jwksSourceWhere the issuer's signing keys come from. Absent reads the issuer's
OpenID Connect discovery document. | object | No | Not specifiedSchema default, where declared: {"type":"discovery"} | None specified |
deployment.authentication.jwksSource.documentRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared. | string | Conditional | Not specified |
|
deployment.authentication.jwksSource.type | string | Yes |
| None specified |
deployment.authentication.jwksSource.uriAn absolute http or https URL with a host preserved as written, no user information, and no backslash, whitespace or control character. DNS case and equivalent IPv6 literals are permitted. | string | Conditional | Not specified |
|
deployment.authentication.policies | object | Yes | Not specified |
|
deployment.authentication.policies.*Map value | object | No | Not specified |
|
deployment.authentication.policies.*.actions | array | Yes | Not specified |
|
deployment.authentication.policies.*.actions[]Array item | string | No |
| None specified |
deployment.authentication.policies.*.operator | boolean | No | Not specifiedSchema default, where declared: false | None specified |
deployment.authentication.policies.*.requiredScopes | array | Yes | Not specified |
|
deployment.authentication.policies.*.requiredScopes[]Array itemAn identifier another system issues, written exactly as its issuer gives it. | string | No | Not specified |
|
deployment.authentication.policies.*.workflowsThe workflows this policy's run actions reach: start, status, inspect,
retry-same, cancel and reconcile. Required when the policy lists a run
action and refused when it lists none. | array | Conditional | Not specified |
|
deployment.authentication.policies.*.workflows[]Array itemAn identifier another system issues, written exactly as its issuer gives it. | string | No | Not specified |
|
deployment.authentication.scopeClaimAn identifier another system issues, written exactly as its issuer gives it. | string | No | Not specifiedSchema default, where declared: "registry_scopes" |
|
deployment.databaseIdAn identifier another system issues, written exactly as its issuer gives it. | string | Yes | Not specified |
|
deployment.listenerThe listener of a runtime that declares its TLS termination and network
exposure. | object | Yes | Not specified | None specified |
deployment.listener.bindSocket address the runtime listens on, written host:port with an IP address host ([addr]:port for IPv6). | string | Yes | Not specified |
|
deployment.listener.networkExposureThe operator-declared private network placement of an HTTP listener. | string | No |
"private-address" | None specified |
deployment.listener.tlsTerminationDeclares the trusted transport boundary for a runtime's plaintext HTTP
listener. Production listeners require operator-controlled upstream TLS
termination; direct plaintext is limited to the explicit loopback-only
development mode. | string | Yes |
| None specified |
deployment.metricsListenerThe operator-private socket /metrics is served on. When it is
omitted, no metrics are served. | object | No | Not specified | None specified |
deployment.metricsListener.bindSocket address the runtime listens on, written host:port with an IP address host ([addr]:port for IPv6). | string | Yes | Not specified |
|
deployment.packagesOne pinned package per workflow. List each package root and digest once. | array | Yes | Not specified |
|
deployment.packages[]Array itemThe package a runtime serves: root is the absolute package directory,
and expectedDigest, when set, pins the package digest the runtime must
find there. The package digest is the digest of the package's
SHA256SUMS file; see [crate::package]. | object | No | Not specified | None specified |
deployment.packages[].expectedDigestsha256: label of the package digest, the digest of the package's
SHA256SUMS file. When set, the runtime refuses to start on any other
package. | string | Yes | Not specified |
|
deployment.packages[].rootAbsolute path of the package directory. | string | Yes | Not specified |
|
deployment.runtimeRole | string | Yes | Not specified |
|
deployment.stateKeys | object | Yes | Not specified |
|
deployment.stateKeys.*Map value | object | No | Not specified |
|
deployment.stateKeys.*.keyRefAn exact secret reference: secret:file/name, resolved under secretProviders.file.root, or secret:env/NAME, resolved only when secretProviders.environment is declared. | string | Yes | Not specified |
|
eventSourcesOptional trusted event producers keyed by the logical IDs used in Workflow triggers. | object | No | Not specified |
|
eventSources.*Map valueTrusted producer binding. Event vocabulary and mapping stay in the package. | object | No | Not specified |
|
eventSources.*.signingKeyRefProtected reference to the raw HMAC-SHA-256 key, at least 32 bytes. | string | Yes | Not specified |
|
eventSources.*.sourceExact absolute producer URI that signed event envelopes must declare. | string | Yes | Not specified |
|
kind | string | Yes |
| None specified |
minimumObservationIntervalSecondsStricter deployment spacing for every product completion observation. | integer | No | Not specifiedSchema default, where declared: 30 |
|
namespace | string | Yes | Not specified |
|
secretProvidersThe secret providers a runtime enables. A reference is resolved only by a
provider declared here: secret:file/name under file.root, and
secret:env/NAME only when environment: {} is present. | object | Yes | Not specified | None specified |
secretProviders.environmentEnables secret:env/NAME references, read from the process
environment. Declared as an empty mapping: environment: {}. | object | Conditional | Not specified | None specified |
secretProviders.fileEnables secret:file/name references, read from files under root. | object | Conditional | Not specified | None specified |
secretProviders.file.rootAbsolute directory holding one file per secret. Each file must be a
regular file owned by the runtime user, mode 0400 or 0600, with exactly
one hard link. | string | Conditional | Not specified |
|
Host operations
Section titled “Host operations”An entry under operations in workflow.yaml names one of these in uses and a connection from
runtime.yaml in connection. There is no other call: no arbitrary HTTP method, SQL, or dynamic
destination. Effect says what the call can change, Recovery what Coordinator does when a response
is lost, and Key whether the call carries an idempotency key. Completion names what a later
wait-for step can wait on. Every operation runs under the connection’s current authority, with
at most 10 attempts of
10 seconds each.
| Operation | Product | Effect | Recovery | Read receipt | Key | Completion |
|---|---|---|---|---|---|---|
breg.invoke-action/v1 | breg | mutation | same-command | No | required | None |
breg.read-record/v1 | breg | read | read-again | No | none | None |
casework.cancel-review-request/v1 | casework | mutation | same-command | No | required | None |
casework.submit-review-request/v1 | casework | mutation | same-command | No | required | result |
evaluation.evaluate/v1 | evaluation | evaluation | hold-after-dispatch | No | none | None |
external.get/v1 | external-http | read | read-again | No | none | None |
messaging.submit-message/v1 | messaging | mutation | same-command-and-receipt | Yes | required | None |
scheduling.create-appointment/v1 | scheduling | mutation | same-command-and-receipt | Yes | required | None |
scheduling.read-availability/v1 | scheduling | read | read-again | No | none | None |
scheduling.read-service/v1 | scheduling | read | read-again | No | none | None |
Check commands
Section titled “Check commands”Every file Coordinator reads has a command that checks it offline, with no service running. Each prints the diagnostics, JSON output, and exit codes that Check a file before you deploy it describes.
| Format and files | Check command |
|---|---|
Coordinator project
| coordinatorctl check --project <project> |
Coordinator runtime configuration
| coordinatorctl check --runtime-config <file> |
Coordinator offline scenarios
| coordinatorctl check --project <project> |