feat: publish initial infrastructure kit collection

.github/workflows/validate.yml

@@ -0,0 +1,20 @@
+name: validate
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+permissions:
+  contents: read
+
+jobs:
+  catalog:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+      - run: python -m pip install -r requirements-dev.txt
+      - run: python -m unittest discover -s tests

.gitignore

@@ -0,0 +1,3 @@
+__pycache__/
+*.pyc
+.venv/

LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 OpenRAE contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.

README.md

@@ -1,2 +1,48 @@
-# reference-packs
-First-party curated environment-pack catalog for RAES.
+# OpenRAE reference infrastructure kits
+
+Reusable, inspectable RAES infrastructure modules for environment-pack authors. Kits are ordinary authoring content: they add no runtime API and make no backend compatibility or realization claim.
+
+The [content strategy](docs/content-strategy.md) defines the eight infrastructure
+concerns, the minimum quality bar for every release, and the boundary between
+reusable authoring content and backend realization.
+
+## Released kits
+
+- `infrastructure.windows-active-directory-domain-controller@1.0.0`
+- `infrastructure.samba-active-directory-domain-controller@1.0.0`
+- `infrastructure.windows-domain-member@1.0.0`
+- `infrastructure.linux-domain-member@1.0.0`
+- `infrastructure.oidc-identity-provider@1.0.0`
+- `infrastructure.ssh-accessible-linux-host@1.0.0`
+- `infrastructure.rdp-accessible-windows-host@1.0.0`
+- `infrastructure.browser-workstation@1.0.0`
+- `infrastructure.authoritative-dns-service@1.0.0`
+- `infrastructure.smb-file-service@1.0.0`
+- `infrastructure.smtp-imap-mail-service@1.0.0`
+- `infrastructure.webmail-service@1.0.0`
+- `infrastructure.static-web-service@1.0.0`
+- `infrastructure.application-api-service@1.0.0`
+- `infrastructure.reverse-proxy-api-gateway@1.0.0`
+- `infrastructure.git-forge@1.0.0`
+- `infrastructure.issue-tracker@1.0.0`
+- `infrastructure.lab-portal@1.0.0`
+- `infrastructure.postgresql-database@1.0.0`
+- `infrastructure.s3-compatible-object-store@1.0.0`
+- `infrastructure.search-index-service@1.0.0`
+- `infrastructure.notebook-environment@1.0.0`
+- `infrastructure.workflow-orchestrator@1.0.0`
+- `infrastructure.model-registry@1.0.0`
+- `infrastructure.text-model-serving@1.0.0`
+- `infrastructure.image-inference-service@1.0.0`
+- `infrastructure.inference-api-gateway@1.0.0`
+- `infrastructure.python-package-resolver@1.0.0`
+- `infrastructure.isolated-python-analysis-sandbox@1.0.0`
+- `infrastructure.python-evaluation-worker@1.0.0`
+- `infrastructure.wazuh-security-monitoring-stack@1.0.0`
+- `infrastructure.suricata-network-intrusion-detection-sensor@1.0.0`
+- `infrastructure.thehive-case-management-service@1.0.0`
+- `infrastructure.shuffle-automation-service@1.0.0`
+- `infrastructure.policy-engine@1.0.0`
+- `infrastructure.telemetry-collector@1.0.0`
+- `infrastructure.observability-evidence-store@1.0.0`
+- `infrastructure.load-rehearsal-runner@1.0.0`

docs/content-strategy.md

@@ -0,0 +1,52 @@
+# Infrastructure kit content strategy
+
+This catalog turns recurring environment infrastructure into independently
+versioned RAES modules that an environment-pack author can discover, inspect,
+parameterize, and compose. The collection covers eight broad concerns:
+
+1. identity and domain services;
+2. access hosts and workstations;
+3. network and shared services;
+4. collaboration and developer services;
+5. data and workflow services;
+6. AI and model-serving services;
+7. security operations services; and
+8. policy and operational services.
+
+The concerns are discovery aids, not coupled release trains. Each kit has its
+own identity and version so authors can select and update only the
+infrastructure their pack needs.
+
+## Minimum release content
+
+Every kit release must provide all of these layers:
+
+- a valid, composable RAES module with explicit exports;
+- a domain-specific parameter in addition to the shared sizing and naming
+  parameters;
+- declared service, identity, data, or integration surfaces appropriate to the
+  infrastructure;
+- at least three benign seed-inventory items that describe useful environment
+  state;
+- pack-local seed and integration assets;
+- planning estimates, limitations, external authoring prerequisites where
+  applicable, and component-inventory inputs;
+- default and materially different parameter-variation composition tests; and
+- an associated-artifact manifest that binds every release file to the exact
+  module snapshot.
+
+The catalog test suite applies these requirements to every released module and
+also composes a representative multi-kit environment. A kit that only renames a
+generic node does not meet the bar.
+
+## Scope discipline
+
+Kits describe static infrastructure and seeded environment state using public
+RAES concepts. They do not introduce objectives, participant behavior, injects,
+events, narrative, or runtime control. They make no claim that a particular
+backend can launch, configure, attach, or observe the declared infrastructure.
+Those realization decisions belong to backend projects.
+
+Credentials and other secrets are never kit parameters or bundled seed data.
+When two kits need a relationship, the consuming pack declares it at the
+composition root; the kits remain independently useful and replaceable.

kits/infrastructure.application-api-service/1.0.0/README.md

@@ -0,0 +1,7 @@
+# Application/API service
+
+Reusable application/api service with domain-specific configuration, declared service surfaces, seeded objects, and pack-local integration material.
+
+The release includes a RAES module, explicit service and identity surfaces, benign seed inventory, planning estimates, component-inventory inputs, integration guidance, and composition tests.
+
+It is authoring content, not a runtime plugin, scenario narrative, backend qualification, or evidence claim.

kits/infrastructure.application-api-service/1.0.0/assets/integration.md

@@ -0,0 +1,15 @@
+# Application/API service integration material
+
+Author parameter: `api_base_path` (default `/api`).
+
+## Exported RAES declarations
+
+- `nodes.application`
+- `content.seed_inventory`
+- `accounts.application_service`
+
+## Composition notes
+
+- No mandatory external authoring prerequisite; connect exported surfaces at the pack composition root as needed.
+- Keep credentials and runtime-selected endpoints outside kit parameters and seed assets.
+- Validate the completed ordinary pack after adding pack-level relationships.

kits/infrastructure.application-api-service/1.0.0/assets/seed.yaml

@@ -0,0 +1,22 @@
+schema_version: environment-kit-seed/v1
+kit: infrastructure.application-api-service
+configuration:
+  api_base_path: /api
+  deployment_profile: standard
+  service_label: application-api-service
+declared_objects:
+- id: api_routes
+  kind: infrastructure-seed
+  sensitivity: non-secret
+- id: health_route
+  kind: infrastructure-seed
+  sensitivity: non-secret
+- id: seed_records
+  kind: infrastructure-seed
+  sensitivity: non-secret
+- id: service_account
+  kind: infrastructure-seed
+  sensitivity: non-secret
+integration_requirements:
+- No mandatory external authoring prerequisite; connect exported surfaces at the pack
+  composition root as needed.

kits/infrastructure.application-api-service/1.0.0/associated-artifacts.json

@@ -0,0 +1,113 @@
+{
+  "schema_version": "associated-artifact-manifest/v1",
+  "manifest_id": "infrastructure.application-api-service-associated-artifacts",
+  "manifest_version": "1.0.0",
+  "canonicalization_profile": "associated-artifact-set/v1",
+  "scope": "scenario",
+  "parent_ref": {
+    "ref_kind": "scenario-snapshot",
+    "ref_id": "application-api-service",
+    "ref_version": null,
+    "ref_digest": "sha256:15343c16b4a4bbb1f5cab44362c7909012f1f70b6aa98d706bf37ad163931f2e",
+    "ref_path": null
+  },
+  "artifacts": {
+    "readme": {
+      "artifact_id": "readme",
+      "role": "documentation",
+      "media_type": "text/markdown",
+      "uri": "raes-environment-kit:/README.md",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "e601eec18bf601b1426a61ee43794c4173ab3673641e6f23740a0b1fec9ce7f4"
+      },
+      "size_bytes": 479,
+      "created_at": "2026-08-01T00:00:00Z",
+      "source": "infrastructure.application-api-service@1.0.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "integration-material": {
+      "artifact_id": "integration-material",
+      "role": "operator-guide",
+      "media_type": "text/markdown",
+      "uri": "raes-environment-kit:/assets/integration.md",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "0b5b6dea0cfa31296c5a41a23a57ed19143f5da2fc6657b6a5a14640a45b8ef4"
+      },
+      "size_bytes": 519,
+      "created_at": "2026-08-01T00:00:00Z",
+      "source": "infrastructure.application-api-service@1.0.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "seed-profile": {
+      "artifact_id": "seed-profile",
+      "role": "configuration",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/assets/seed.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "f327d3afd9a2a5bc0852d65bdc7a3af18db5d803fdfeeffe325930b9fcc3522a"
+      },
+      "size_bytes": 646,
+      "created_at": "2026-08-01T00:00:00Z",
+      "source": "infrastructure.application-api-service@1.0.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "kit-manifest": {
+      "artifact_id": "kit-manifest",
+      "role": "manifest",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/kit.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "de998f50999c2bb880c061c4c02f27002c871634c0cc360ddaaadc36065dbf46"
+      },
+      "size_bytes": 1698,
+      "created_at": "2026-08-01T00:00:00Z",
+      "source": "infrastructure.application-api-service@1.0.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "module": {
+      "artifact_id": "module",
+      "role": "configuration",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/module.sdl.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "ded3777b4fe797ca4841a6df3782026060b0cf9d22d775508d6fea68b884dd84"
+      },
+      "size_bytes": 2776,
+      "created_at": "2026-08-01T00:00:00Z",
+      "source": "infrastructure.application-api-service@1.0.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    },
+    "composition-tests": {
+      "artifact_id": "composition-tests",
+      "role": "configuration",
+      "media_type": "application/yaml",
+      "uri": "raes-environment-kit:/tests/composition.yaml",
+      "checksum": {
+        "algorithm": "sha256",
+        "value": "733c5117c59c5d2dbf7cfeb0a25594f989dd1ad8f22bdfeee760ea43223cc066"
+      },
+      "size_bytes": 248,
+      "created_at": "2026-08-01T00:00:00Z",
+      "source": "infrastructure.application-api-service@1.0.0",
+      "satisfies_refs": [],
+      "sensitivity": "public",
+      "description": null
+    }
+  },
+  "set_digest": "sha256:f87df17502e6a18c0637d50b852d3e61323f56769fbc3110ddb4203bf8749a46"
+}

kits/infrastructure.application-api-service/1.0.0/kit.yaml

@@ -0,0 +1,49 @@
+schema_version: environment-pack-kit/v1
+id: infrastructure.application-api-service
+version: 1.0.0
+title: Application/API service
+summary: Reusable application/api service with domain-specific configuration, declared
+  service surfaces, seeded objects, and pack-local integration material.
+concern: network-shared
+released_at: '2026-08-01T00:00:00Z'
+module:
+  path: module.sdl.yaml
+assets:
+- source: assets/integration.md
+  target: assets/kits/application-api-service/integration.md
+  visibility: operator
+  artifact_id: integration-material
+- source: assets/seed.yaml
+  target: assets/kits/application-api-service/seed.yaml
+  visibility: operator
+  artifact_id: seed-profile
+resources:
+  cpu_cores: 2
+  memory_mib: 2048
+  storage_mib: 4096
+  notes: Planning estimates only; realization sizing remains backend-owned.
+prerequisites: []
+limitations:
+- Declares static infrastructure, seeded state, and integration surfaces only.
+- Does not claim launch, readiness, traffic attachment, credential delivery, or runtime
+  evidence.
+- No mandatory external authoring prerequisite; connect exported surfaces at the pack
+  composition root as needed.
+license:
+  expression: MIT
+  redistribution: open
+  attribution: OpenRAE contributors
+tests:
+- path: tests/composition.yaml
+  kind: validate
+- path: tests/composition.yaml
+  kind: parameter-variation
+- path: tests/composition.yaml
+  kind: multi-kit
+component_inventory:
+- scope: unresolved
+  authority: raes-source
+  ref: /nodes/application/source
+  description: RAES carries the declared application-service stable source; immutable
+    artifact selection remains unresolved until pack publication.
+associated_artifact_manifest: associated-artifacts.json