application.schema.json

{
  "$id": "https://onebox.run/schemas/application/v1alpha1/application.schema.json",
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "additionalProperties": false,
  "description": "One application, its workloads, the services it needs, and how a release rolls out.",
  "properties": {
    "apiVersion": {
      "const": "onebox.run/v1alpha1",
      "description": "Authored Application API identity.",
      "type": "string"
    },
    "kind": {
      "const": "Application",
      "description": "Authored resource kind.",
      "type": "string"
    },
    "metadata": {
      "additionalProperties": false,
      "description": "Application identity and opaque user metadata.",
      "properties": {
        "annotations": {
          "additionalProperties": {
            "type": "string"
          },
          "description": "Opaque user metadata that never affects plans or runtime behavior.",
          "type": "object"
        },
        "name": {
          "description": "The application's name. Expects lower-case letters, digits and hyphens, starting with a letter, at most 40 characters, and may not begin \"ob-\" or be a name the host layout reserves. Stable application name used in generated runtime identities.",
          "examples": [
            "shop"
          ],
          "not": {
            "anyOf": [
              {
                "pattern": "^ob-"
              },
              {
                "const": "ob"
              },
              {
                "const": "onebox-proxy"
              },
              {
                "const": "_host"
              }
            ]
          },
          "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$"
        }
      },
      "required": [
        "name"
      ],
      "type": "object"
    },
    "spec": {
      "additionalProperties": false,
      "description": "Desired Onebox application configuration.",
      "properties": {
        "backupTargets": {
          "additionalProperties": {
            "additionalProperties": false,
            "properties": {
              "bucket": {
                "description": "Existing destination bucket used by this target. Expects a lower-case S3-compatible bucket name between 3 and 63 characters.",
                "examples": [
                  "onebox-backups"
                ],
                "pattern": "^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$",
                "type": "string"
              },
              "credentials": {
                "additionalProperties": false,
                "description": "Trusted encrypted-file entries containing destination credentials; values never appear in the project.",
                "properties": {
                  "accessKeyEntry": {
                    "description": "Variable name containing the destination access key. Expects a variable name of letters, digits and underscores, not starting with a digit.",
                    "examples": [
                      "BACKUP_ACCESS_KEY_ID"
                    ],
                    "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
                    "type": "string"
                  },
                  "file": {
                    "description": "Repository-relative encrypted credential file staged through the trusted secret flow. Expects a path inside the repository, with no control character or shell metacharacter.",
                    "examples": [
                      "secrets/backup.env"
                    ],
                    "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                    "type": "string"
                  },
                  "provider": {
                    "default": "Sops",
                    "description": "Trusted secret provider. Only sops is currently executable.",
                    "enum": [
                      "Sops"
                    ],
                    "type": "string"
                  },
                  "secretKeyEntry": {
                    "description": "Variable name containing the destination secret key. Expects a variable name of letters, digits and underscores, not starting with a digit.",
                    "examples": [
                      "BACKUP_SECRET_ACCESS_KEY"
                    ],
                    "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
                    "type": "string"
                  },
                  "sessionTokenEntry": {
                    "description": "Optional variable name containing a temporary destination session token. Expects a variable name of letters, digits and underscores, not starting with a digit.",
                    "examples": [
                      "BACKUP_SESSION_TOKEN"
                    ],
                    "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "encryption": {
                "additionalProperties": false,
                "description": "Required encryption mode for each recovery kind this target may store.",
                "properties": {
                  "cold": {
                    "description": "Encryption mode required for cold recovery: client-side or server-side.",
                    "enum": [
                      "ClientSide",
                      "ServerSide"
                    ],
                    "type": "string"
                  },
                  "pitr": {
                    "description": "Encryption mode required for point-in-time recovery: client-side or server-side.",
                    "enum": [
                      "ClientSide",
                      "ServerSide"
                    ],
                    "type": "string"
                  },
                  "snapshot": {
                    "description": "Encryption mode required for snapshot recovery: client-side or server-side.",
                    "enum": [
                      "ClientSide",
                      "ServerSide"
                    ],
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "endpoint": {
                "description": "Destination API endpoint. HTTPS is required unless tls is explicitly insecure. Expects an http or https URL.",
                "examples": [
                  "https://objects.example.com"
                ],
                "pattern": "^https?://",
                "type": "string"
              },
              "failureDomain": {
                "additionalProperties": false,
                "description": "Operator-declared identity used to prove the destination does not share the protected host.",
                "properties": {
                  "host": {
                    "description": "Destination host identity used to refuse a target on the protected host. Expects a stable identifier of letters, digits, dots, colons, slashes, underscores and hyphens.",
                    "examples": [
                      "backup-01.example.net"
                    ],
                    "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$",
                    "type": "string"
                  },
                  "identity": {
                    "description": "Stable operator-owned failure-domain identity, distinct from the protected host. Expects a stable identifier of letters, digits, dots, colons, slashes, underscores and hyphens.",
                    "examples": [
                      "provider-a/us-east-1/account-42"
                    ],
                    "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "kind": {
                "description": "Destination kind. Only s3-compatible is supported.",
                "enum": [
                  "S3Compatible"
                ],
                "examples": [
                  "s3-compatible"
                ],
                "type": "string"
              },
              "prefix": {
                "description": "Non-secret object prefix reserved for Onebox backup data. Expects a relative object prefix with no empty leading component or shell metacharacter.",
                "examples": [
                  "production/shop"
                ],
                "pattern": "^[A-Za-z0-9][A-Za-z0-9._/-]{0,511}$",
                "type": "string"
              },
              "region": {
                "description": "S3-compatible region when the endpoint requires one. Expects a lower-case S3-compatible region of letters, digits and hyphens.",
                "examples": [
                  "us-east-1"
                ],
                "pattern": "^[a-z0-9][a-z0-9-]{0,62}$",
                "type": "string"
              },
              "tls": {
                "default": "Verify",
                "description": "Transport policy: verify, or skip-verify to accept a plaintext http endpoint.",
                "enum": [
                  "Verify",
                  "SkipVerify"
                ],
                "type": "string"
              }
            },
            "type": "object"
          },
          "description": "User-owned off-host repositories available to service backup policies.",
          "type": "object"
        },
        "basePath": {
          "default": "/var/lib/ob",
          "description": "Absolute host directory beneath which Onebox stores application state and releases. Expects an absolute path with no control character or shell metacharacter.",
          "examples": [
            "/srv/ob"
          ],
          "pattern": "^/[^\\x00-\\x1f'\"$`\\\\]*$",
          "type": "string"
        },
        "checks": {
          "additionalProperties": false,
          "description": "Assertions that must pass before a release becomes current unless marked advisory.",
          "properties": {
            "exec": {
              "description": "Commands run inside a named workload.",
              "items": {
                "additionalProperties": false,
                "properties": {
                  "advisory": {
                    "default": false,
                    "description": "Report a failure without blocking release activation.",
                    "type": "boolean"
                  },
                  "run": {
                    "description": "Shell command verified inside the workload.",
                    "examples": [
                      "test -f /srv/ready"
                    ],
                    "type": "string"
                  },
                  "workload": {
                    "description": "Workload the command runs inside.",
                    "examples": [
                      "web"
                    ],
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "type": "array"
            },
            "http": {
              "description": "HTTP paths probed inside a named workload.",
              "items": {
                "additionalProperties": false,
                "properties": {
                  "advisory": {
                    "default": false,
                    "description": "Report a failure without blocking release activation.",
                    "type": "boolean"
                  },
                  "path": {
                    "description": "HTTP path verified inside the workload. Expects a path beginning with /.",
                    "examples": [
                      "/healthz"
                    ],
                    "pattern": "^/[^\\x00-\\x1f'\"$` \\\\]*$",
                    "type": "string"
                  },
                  "port": {
                    "description": "Container port to probe.",
                    "examples": [
                      3000
                    ],
                    "maximum": 65535,
                    "minimum": 1,
                    "type": "integer"
                  },
                  "workload": {
                    "description": "Workload the path is probed inside.",
                    "examples": [
                      "web"
                    ],
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "type": "array"
            },
            "migrations": {
              "description": "Migration revisions checked against captured job evidence.",
              "items": {
                "additionalProperties": false,
                "properties": {
                  "advisory": {
                    "default": false,
                    "description": "Report a failure without blocking release activation.",
                    "type": "boolean"
                  },
                  "appliedRevisions": {
                    "description": "Revisions the job must report as applied.",
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "job": {
                    "description": "Job workload whose captured evidence is checked.",
                    "examples": [
                      "migrate"
                    ],
                    "type": "string"
                  },
                  "provider": {
                    "description": "Migration tool that produced the revisions.",
                    "examples": [
                      "alembic"
                    ],
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "type": "array"
            },
            "url": {
              "description": "External URLs probed from the operator side.",
              "items": {
                "additionalProperties": false,
                "properties": {
                  "advisory": {
                    "default": false,
                    "description": "Report a failure without blocking release activation.",
                    "type": "boolean"
                  },
                  "contains": {
                    "description": "Text the response body must contain.",
                    "type": "string"
                  },
                  "jsonAssertions": {
                    "description": "Scalar JSON response values that must match exactly.",
                    "items": {
                      "additionalProperties": false,
                      "properties": {
                        "equals": {
                          "description": "Exact scalar value required at path."
                        },
                        "path": {
                          "description": "Dot-separated path to a scalar value in the JSON response.",
                          "examples": [
                            "service.ready"
                          ],
                          "type": "string"
                        }
                      },
                      "type": "object"
                    },
                    "type": "array"
                  },
                  "requiredHeaders": {
                    "additionalProperties": {
                      "type": "string"
                    },
                    "description": "Exact response headers required for success.",
                    "type": "object"
                  },
                  "statusCodes": {
                    "description": "Allowed response status codes. A successful 2xx response is expected when omitted.",
                    "items": {
                      "maximum": 599,
                      "minimum": 100,
                      "type": "integer"
                    },
                    "type": "array"
                  },
                  "url": {
                    "description": "External HTTP or HTTPS URL verified from the operator side. Expects an http or https URL.",
                    "examples": [
                      "https://shop.example.com/healthz"
                    ],
                    "pattern": "^https?://",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "type": "array"
            }
          },
          "type": "object"
        },
        "deployment": {
          "additionalProperties": false,
          "description": "Release ordering, retention, and migration behavior.",
          "properties": {
            "migrationPolicy": {
              "default": "Manual",
              "description": "Policy for migration jobs during release and recovery.",
              "enum": [
                "Manual",
                "Auto",
                "ExpandOnly"
              ],
              "type": "string"
            },
            "order": {
              "description": "Explicit workload release order. Dependency order is derived when omitted.",
              "items": {
                "type": "string"
              },
              "type": "array"
            },
            "retainReleases": {
              "default": 5,
              "description": "Number of completed release directories retained for inspection and rollback.",
              "minimum": 1,
              "type": "integer"
            }
          },
          "type": "object"
        },
        "environments": {
          "additionalProperties": {
            "additionalProperties": false,
            "properties": {
              "basePath": {
                "description": "Environment-specific replacement for the Application basePath. Expects an absolute path with no control character or shell metacharacter.",
                "examples": [
                  "/srv/ob"
                ],
                "pattern": "^/[^\\x00-\\x1f'\"$`\\\\]*$",
                "type": "string"
              },
              "envFiles": {
                "description": "Default ordered environment-file list for application, worker, and job workloads in this environment.",
                "items": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "additionalProperties": false,
                      "properties": {
                        "file": {
                          "description": "Repository-relative environment file path. Expects a path inside the repository, with no control character or shell metacharacter.",
                          "examples": [
                            ".env.production"
                          ],
                          "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                          "type": "string"
                        },
                        "provider": {
                          "description": "Decryptor used before staging the file. The supported encrypted provider is sops.",
                          "enum": [
                            "Sops"
                          ],
                          "examples": [
                            "sops"
                          ],
                          "type": "string"
                        }
                      },
                      "required": [
                        "file"
                      ],
                      "type": "object"
                    }
                  ],
                  "description": "Also accepts a path to an environment file."
                },
                "type": "array"
              },
              "jump": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "additionalProperties": false,
                    "description": "Optional SSH jump host tunnelling the connection to this server, written as user@host or as an object with host, user, and port. Onebox verifies and authenticates both hops and never forwards the SSH agent.",
                    "examples": [
                      "deploy@bastion.example.com"
                    ],
                    "properties": {
                      "host": {
                        "description": "Jump host name or IP address.",
                        "examples": [
                          "bastion.example.com"
                        ],
                        "type": "string"
                      },
                      "port": {
                        "description": "SSH port on the jump host. The SSH default is used when omitted.",
                        "examples": [
                          2222
                        ],
                        "type": "integer"
                      },
                      "user": {
                        "description": "SSH user on the jump host. $USER is used when omitted; ob does not read ~/.ssh/config.",
                        "examples": [
                          "deploy"
                        ],
                        "type": "string"
                      }
                    },
                    "type": "object"
                  }
                ],
                "description": "Optional SSH jump host tunnelling the connection to this server, written as user@host or as an object with host, user, and port. Onebox verifies and authenticates both hops and never forwards the SSH agent. Also accepts user@host or user@host:port."
              },
              "overrides": {
                "additionalProperties": false,
                "description": "Environment-specific operational tuning. Overrides cannot change workload identity or data semantics.",
                "properties": {
                  "services": {
                    "additionalProperties": {
                      "additionalProperties": {},
                      "type": "object"
                    },
                    "description": "Allowed service tuning keyed by service name: resources and settings.",
                    "type": "object"
                  },
                  "workloads": {
                    "additionalProperties": {
                      "additionalProperties": {},
                      "type": "object"
                    },
                    "description": "Allowed workload tuning keyed by workload name: replicas, resources, env, envFiles, strategy, and routes.",
                    "type": "object"
                  }
                },
                "type": "object"
              },
              "policy": {
                "additionalProperties": false,
                "description": "Approval, runner compatibility, and migration-backup requirements for this environment.",
                "properties": {
                  "allowAgentProposals": {
                    "default": true,
                    "description": "Declared permission for agent-authored proposals. The current CLI does not distinguish agent identity; execution remains approval-gated.",
                    "type": "boolean"
                  },
                  "migrations": {
                    "additionalProperties": false,
                    "description": "What this environment requires of a release carrying migration risk.",
                    "properties": {
                      "backupKeyMaterial": {
                        "description": "Key-material identities the backup report must name.",
                        "examples": [
                          [
                            "BACKUP_ACCESS_KEY_ID"
                          ]
                        ],
                        "items": {
                          "type": "string"
                        },
                        "type": "array"
                      },
                      "backupMaxAge": {
                        "default": "24h",
                        "description": "Maximum age of a backup report accepted for a migration. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                        "examples": [
                          "24h"
                        ],
                        "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                        "type": "string"
                      },
                      "requireBackup": {
                        "default": false,
                        "description": "Require a plan-bound backup report before a release with migration risk.",
                        "type": "boolean"
                      },
                      "requireRestoreTest": {
                        "default": false,
                        "description": "Require the backup report to state that a restore test succeeded.",
                        "type": "boolean"
                      }
                    },
                    "type": "object"
                  },
                  "minOneboxVersion": {
                    "description": "Oldest released Onebox runner allowed to operate this environment. Expects a CalVer release such as v2026.8.0.",
                    "examples": [
                      "v2026.8.0"
                    ],
                    "pattern": "^v([1-9][0-9]{3})\\.([1-9]|1[0-2])\\.(0|[1-9][0-9]{0,18})$",
                    "type": "string"
                  },
                  "minPlanSchema": {
                    "description": "Oldest executable plan schema accepted by this environment. Expects a plan schema identity such as onebox.run/executable-deploy-plan/v1alpha2.",
                    "examples": [
                      "onebox.run/executable-deploy-plan/v1alpha2"
                    ],
                    "pattern": "^onebox\\.run/executable-deploy-plan/v[1-9][0-9]*((alpha|beta)[1-9][0-9]*)?$",
                    "type": "string"
                  },
                  "requireApproval": {
                    "default": true,
                    "description": "Require a plan-bound local confirmation before mutating this environment.",
                    "type": "boolean"
                  }
                },
                "type": "object"
              },
              "server": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "additionalProperties": false,
                    "description": "SSH server, written as user@host or as an object with host, user, and port.",
                    "examples": [
                      "root@203.0.113.10"
                    ],
                    "properties": {
                      "host": {
                        "description": "SSH hostname or IP address.",
                        "examples": [
                          "203.0.113.10"
                        ],
                        "type": "string"
                      },
                      "port": {
                        "description": "SSH port. The SSH default is used when omitted.",
                        "examples": [
                          2222
                        ],
                        "type": "integer"
                      },
                      "user": {
                        "description": "SSH user. $USER is used when omitted; ob does not read ~/.ssh/config.",
                        "examples": [
                          "root"
                        ],
                        "type": "string"
                      }
                    },
                    "type": "object"
                  }
                ],
                "description": "SSH server, written as user@host or as an object with host, user, and port. Also accepts user@host."
              }
            },
            "type": "object"
          },
          "description": "Named environments, each naming the server it deploys to and the policy applied to it.",
          "minProperties": 1,
          "type": "object"
        },
        "externalServices": {
          "additionalProperties": {
            "additionalProperties": false,
            "properties": {
              "backupOwner": {
                "description": "Operator or provider responsible for backup, restore, upgrades, credentials, and durability. Expects a stable operator or provider identity of letters, digits, dots, @, colons, slashes, underscores and hyphens.",
                "examples": [
                  "platform-team/rds"
                ],
                "pattern": "^[A-Za-z0-9][A-Za-z0-9._@:/-]{0,127}$",
                "type": "string"
              },
              "connection": {
                "additionalProperties": false,
                "description": "Trusted connection source and driver-shaped entry mapping.",
                "properties": {
                  "entries": {
                    "additionalProperties": {
                      "description": "Expects a variable name of letters, digits and underscores, not starting with a digit.",
                      "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
                      "type": "string"
                    },
                    "description": "Maps driver connection parts such as host, port, user, password, database, or url to variable names in the trusted source.",
                    "type": "object"
                  },
                  "source": {
                    "additionalProperties": false,
                    "description": "Trusted encrypted file containing the connection values.",
                    "properties": {
                      "file": {
                        "description": "Repository-relative encrypted environment file staged through the trusted secret flow. Expects a path inside the repository, with no control character or shell metacharacter.",
                        "examples": [
                          "secrets/production-db.env"
                        ],
                        "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                        "type": "string"
                      },
                      "provider": {
                        "default": "Sops",
                        "description": "Trusted secret provider. Only sops is currently executable.",
                        "enum": [
                          "Sops"
                        ],
                        "type": "string"
                      }
                    },
                    "type": "object"
                  }
                },
                "type": "object"
              },
              "driver": {
                "description": "Built-in connection shape used to validate and project this dependency.",
                "enum": [
                  "clickhouse",
                  "mariadb",
                  "meilisearch",
                  "minio",
                  "mongodb",
                  "mysql",
                  "nats",
                  "postgres",
                  "rabbitmq",
                  "redis",
                  "valkey"
                ],
                "examples": [
                  "postgres"
                ],
                "type": "string"
              },
              "probe": {
                "additionalProperties": false,
                "description": "Optional bounded read-only health observation; it never creates or repairs provider resources.",
                "properties": {
                  "kind": {
                    "default": "DriverHealth",
                    "description": "Read-only observation kind: driver-health.",
                    "enum": [
                      "DriverHealth"
                    ],
                    "type": "string"
                  },
                  "maxAge": {
                    "default": "5m",
                    "description": "Maximum age of a probe observation bound into a plan. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                    "examples": [
                      "5m"
                    ],
                    "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                    "type": "string"
                  },
                  "timeout": {
                    "default": "5s",
                    "description": "Maximum duration of one read-only probe. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                    "examples": [
                      "5s"
                    ],
                    "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                    "type": "string"
                  }
                },
                "type": "object"
              }
            },
            "type": "object"
          },
          "description": "Typed dependencies operated outside Onebox. Their connection projection is trusted, but their lifecycle and backup remain external.",
          "type": "object"
        },
        "hooks": {
          "additionalProperties": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "additionalProperties": false,
                "properties": {
                  "local": {
                    "default": false,
                    "description": "Run on the operator machine instead of the server.",
                    "type": "boolean"
                  },
                  "run": {
                    "description": "Command executed at the lifecycle seam.",
                    "examples": [
                      "./scripts/notify.sh"
                    ],
                    "type": "string"
                  }
                },
                "type": "object"
              }
            ],
            "description": "Also accepts the command to run."
          },
          "description": "Lifecycle commands keyed by seam: bootstrap, pre_release, post_release, or post_deploy.",
          "type": "object"
        },
        "notifications": {
          "additionalProperties": {
            "additionalProperties": false,
            "properties": {
              "format": {
                "default": "Text",
                "description": "Notification payload format.",
                "enum": [
                  "Text",
                  "JSON"
                ],
                "type": "string"
              },
              "on": {
                "default": [
                  "success",
                  "failure"
                ],
                "description": "Operation outcomes that trigger this notification.",
                "items": {
                  "enum": [
                    "Success",
                    "Failure"
                  ],
                  "type": "string"
                },
                "type": "array"
              },
              "webhook": {
                "description": "HTTP endpoint that receives outcome notifications.",
                "examples": [
                  "https://hooks.example.com/onebox"
                ],
                "type": "string"
              }
            },
            "type": "object"
          },
          "description": "Named webhooks that receive selected operation and scheduled-job outcomes.",
          "type": "object"
        },
        "proxy": {
          "additionalProperties": false,
          "description": "Ownership and configuration of the host ingress proxy.",
          "properties": {
            "config": {
              "description": "Repository-relative proxy configuration directory. Dynamic YAML or TOML files extend Onebox's managed configuration. A managed DNS challenge may use a directory containing only .env for provider credentials. Including traefik.yml or traefik.yaml instead takes ownership of the static configuration, which must use the watched file-provider directory /etc/traefik/dynamic, must not enable the Docker provider, must define certificatesResolvers.letsencrypt for exact terminating routes, and must define the DNS-01 certificatesResolvers.onebox-wildcard for wildcard terminating routes. Dynamic files may not reuse Onebox-generated router or service names or redefine the managed onebox-compress middleware. Expects a path inside the repository, with no control character or shell metacharacter.",
              "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
              "type": "string"
            },
            "dnsChallenge": {
              "additionalProperties": false,
              "description": "Managed ACME DNS-01 challenge used to issue wildcard certificates. Provider credentials belong in proxy.config/.env; Onebox continues to own the static proxy configuration.",
              "properties": {
                "provider": {
                  "description": "Traefik DNS challenge provider name. Its credential variables must be supplied through proxy.config/.env. Expects a lower-case Traefik DNS provider name such as cloudflare or route53.",
                  "examples": [
                    "cloudflare"
                  ],
                  "pattern": "^[a-z][a-z0-9_-]*$",
                  "type": "string"
                },
                "resolvers": {
                  "description": "DNS resolvers used to verify challenge propagation, written as host:port.",
                  "examples": [
                    [
                      "1.1.1.1:53"
                    ]
                  ],
                  "items": {
                    "description": "Expects a lower-case DNS name, IPv4 address, or bracketed IPv6 address followed by a port.",
                    "pattern": "^([a-z0-9]([a-z0-9.-]*[a-z0-9])?|\\[[0-9A-Fa-f:.]+\\]):[0-9]{1,5}$",
                    "type": "string"
                  },
                  "type": "array"
                }
              },
              "required": [
                "provider"
              ],
              "type": "object"
            },
            "entrypoints": {
              "additionalProperties": {
                "additionalProperties": false,
                "properties": {
                  "port": {
                    "description": "Host and proxy-container TCP port used by this listener.",
                    "examples": [
                      4317
                    ],
                    "maximum": 65535,
                    "minimum": 1,
                    "type": "integer"
                  }
                },
                "type": "object"
              },
              "description": "Additional named TCP listeners published by the managed proxy. Onebox adds them to its generated static configuration; a proxy.config containing custom traefik.yml or traefik.yaml must define matching Traefik entrypoints.",
              "propertyNames": {
                "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$"
              },
              "type": "object"
            },
            "image": {
              "description": "Container image used for the managed proxy. Expects a registry reference such as nginx:1.27 or ghcr.io/acme/app@sha256:….",
              "pattern": "^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\\[(?:[a-fA-F0-9:]+)\\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\\w][\\w.-]{0,127}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}))?$",
              "type": "string"
            },
            "kind": {
              "default": "TraefikDocker",
              "description": "Proxy implementation, or none to disable routing.",
              "enum": [
                "TraefikDocker",
                "None"
              ],
              "type": "string"
            },
            "managed": {
              "description": "Let Onebox converge the host-scoped proxy when routes are declared.",
              "type": "boolean"
            },
            "network": {
              "default": "ob-ingress",
              "description": "External container network shared with routed workloads; default and Onebox's derived application and service network names are reserved.",
              "type": "string"
            }
          },
          "type": "object"
        },
        "registries": {
          "additionalProperties": {
            "additionalProperties": false,
            "properties": {
              "passwordEnv": {
                "description": "Local environment-variable name containing the registry password or token. Expects a variable name of letters, digits and underscores, not starting with a digit.",
                "examples": [
                  "GHCR_TOKEN"
                ],
                "pattern": "^[A-Za-z_][A-Za-z0-9_]*$",
                "type": "string"
              },
              "server": {
                "description": "Registry hostname, optionally with a port. Expects a host with an optional port and path, such as ghcr.io or registry.example.com:5000.",
                "examples": [
                  "ghcr.io"
                ],
                "pattern": "^[A-Za-z0-9][A-Za-z0-9.-]*(:[0-9]{1,5})?(/[A-Za-z0-9._/-]*)?$",
                "type": "string"
              },
              "username": {
                "description": "Registry login username. Expects a username of letters, digits and . _ @ + -.",
                "pattern": "^[A-Za-z0-9][A-Za-z0-9._@+-]*$",
                "type": "string"
              }
            },
            "type": "object"
          },
          "description": "Named container registries and the environment variables holding their credentials.",
          "type": "object"
        },
        "runtime": {
          "additionalProperties": false,
          "description": "Project-wide environment files and local environment-file requirements.",
          "properties": {
            "envChecks": {
              "description": "Local environment-file assertions checked before planning or deploying.",
              "items": {
                "additionalProperties": false,
                "properties": {
                  "file": {
                    "description": "Repository-relative dotenv file whose declared keys are checked. Expects a path inside the repository, with no control character or shell metacharacter.",
                    "examples": [
                      ".env.production"
                    ],
                    "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                    "type": "string"
                  },
                  "present": {
                    "description": "Environment keys that must be declared but may be empty.",
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "require": {
                    "description": "Environment keys that must be declared with non-empty values.",
                    "items": {
                      "type": "string"
                    },
                    "type": "array"
                  }
                },
                "type": "object"
              },
              "type": "array"
            },
            "envFiles": {
              "description": "Project-wide ordered environment-file list for application, worker, and job workloads.",
              "items": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "additionalProperties": false,
                    "properties": {
                      "file": {
                        "description": "Repository-relative environment file path. Expects a path inside the repository, with no control character or shell metacharacter.",
                        "examples": [
                          ".env.production"
                        ],
                        "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                        "type": "string"
                      },
                      "provider": {
                        "description": "Decryptor used before staging the file. The supported encrypted provider is sops.",
                        "enum": [
                          "Sops"
                        ],
                        "examples": [
                          "sops"
                        ],
                        "type": "string"
                      }
                    },
                    "required": [
                      "file"
                    ],
                    "type": "object"
                  }
                ],
                "description": "Also accepts a path to an environment file."
              },
              "type": "array"
            }
          },
          "type": "object"
        },
        "services": {
          "additionalProperties": {
            "anyOf": [
              {
                "type": [
                  "string",
                  "number",
                  "integer"
                ]
              },
              {
                "additionalProperties": false,
                "properties": {
                  "backup": {
                    "additionalProperties": false,
                    "description": "Recovery intent for this service. Onebox selects the qualified native implementation; declaring intent alone does not establish backup.",
                    "properties": {
                      "allowDowntime": {
                        "default": false,
                        "description": "Whether recurring backup operations may use the driver-declared stopped-service window.",
                        "type": "boolean"
                      },
                      "drill": {
                        "additionalProperties": false,
                        "description": "Exact isolated restore-test schedule, proof age, and optional staging filesystem.",
                        "properties": {
                          "maxAge": {
                            "default": "7d",
                            "description": "Maximum age of the latest passing restore proof. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                            "examples": [
                              "7d"
                            ],
                            "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                            "type": "string"
                          },
                          "schedule": {
                            "additionalProperties": false,
                            "description": "Exact recurring isolated restore-test schedule.",
                            "properties": {
                              "cron": {
                                "description": "Five-field cron schedule translated to a host timer. Expects five cron fields.",
                                "examples": [
                                  "0 2 * * *"
                                ],
                                "pattern": "^[-0-9*/,A-Za-z ]+$",
                                "type": "string"
                              },
                              "timezone": {
                                "default": "UTC",
                                "description": "IANA timezone used to interpret the cron schedule. Expects an IANA zone name such as UTC or Europe/Berlin.",
                                "examples": [
                                  "Europe/Berlin"
                                ],
                                "pattern": "^[A-Za-z][A-Za-z0-9_+-]*(/[A-Za-z0-9_+-]+)*$",
                                "type": "string"
                              }
                            },
                            "type": "object"
                          }
                        },
                        "type": "object"
                      },
                      "maxDataLoss": {
                        "description": "Maximum tolerable interval between the latest recoverable point and failure. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                        "examples": [
                          "15m"
                        ],
                        "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                        "type": "string"
                      },
                      "recoveryKind": {
                        "description": "Required recovery envelope: snapshot, pitr, or cold.",
                        "enum": [
                          "Snapshot",
                          "Pitr",
                          "Cold"
                        ],
                        "examples": [
                          "pitr"
                        ],
                        "type": "string"
                      },
                      "retention": {
                        "additionalProperties": false,
                        "description": "Portable minimum recovery history that the selected native driver must be able to preserve.",
                        "properties": {
                          "keep": {
                            "default": 7,
                            "description": "Minimum number of independently recoverable base generations to retain.",
                            "examples": [
                              7
                            ],
                            "minimum": 1,
                            "type": "integer"
                          },
                          "window": {
                            "default": "7d",
                            "description": "Minimum continuous recovery history the native retention mapping must preserve. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                            "examples": [
                              "7d"
                            ],
                            "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                            "type": "string"
                          }
                        },
                        "type": "object"
                      },
                      "schedule": {
                        "additionalProperties": false,
                        "description": "Exact recurring base-backup schedule.",
                        "properties": {
                          "cron": {
                            "description": "Five-field cron schedule translated to a host timer. Expects five cron fields.",
                            "examples": [
                              "0 2 * * *"
                            ],
                            "pattern": "^[-0-9*/,A-Za-z ]+$",
                            "type": "string"
                          },
                          "timezone": {
                            "default": "UTC",
                            "description": "IANA timezone used to interpret the cron schedule. Expects an IANA zone name such as UTC or Europe/Berlin.",
                            "examples": [
                              "Europe/Berlin"
                            ],
                            "pattern": "^[A-Za-z][A-Za-z0-9_+-]*(/[A-Za-z0-9_+-]+)*$",
                            "type": "string"
                          }
                        },
                        "type": "object"
                      },
                      "target": {
                        "description": "Name of a project-level backup target. Expects lower-case letters, digits and hyphens, starting with a letter, at most 40 characters.",
                        "examples": [
                          "offsite"
                        ],
                        "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$",
                        "type": "string"
                      }
                    },
                    "type": "object"
                  },
                  "driver": {
                    "description": "Built-in service driver. Defaults to the service map key. Expects lower-case letters, digits and hyphens, starting with a letter, at most 40 characters.",
                    "examples": [
                      "postgres"
                    ],
                    "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$",
                    "type": "string"
                  },
                  "features": {
                    "additionalProperties": false,
                    "description": "Capabilities Onebox must establish before application workloads run.",
                    "properties": {
                      "extensions": {
                        "additionalProperties": {
                          "additionalProperties": false,
                          "properties": {},
                          "type": "object"
                        },
                        "description": "PostgreSQL extensions Onebox installs in the managed application database before application migrations run.",
                        "propertyNames": {
                          "pattern": "^[a-z][a-z0-9_-]*$"
                        },
                        "type": "object"
                      }
                    },
                    "type": "object"
                  },
                  "persistence": {
                    "additionalProperties": false,
                    "description": "Data-lifetime declaration for this supporting service.",
                    "properties": {
                      "mode": {
                        "default": "Durable",
                        "description": "Data lifetime: durable, ephemeral, or external.",
                        "enum": [
                          "Durable",
                          "Ephemeral",
                          "External"
                        ],
                        "type": "string"
                      }
                    },
                    "type": "object"
                  },
                  "resources": {
                    "additionalProperties": false,
                    "description": "Memory and CPU limits for this supporting service.",
                    "properties": {
                      "cpus": {
                        "description": "Container CPU limit expressed as a positive decimal count. Expects a number of CPUs such as 0.5 or 2.",
                        "examples": [
                          "0.5"
                        ],
                        "pattern": "^[0-9]+(\\.[0-9]+)?$",
                        "type": "string"
                      },
                      "memory": {
                        "description": "Container memory limit. Expects a size such as 512MB or 1.5GB.",
                        "examples": [
                          "512MB"
                        ],
                        "pattern": "^[0-9]+(\\.[0-9]+)?(B|KB|MB|GB|TB)$",
                        "type": "string"
                      }
                    },
                    "type": "object"
                  },
                  "settings": {
                    "additionalProperties": {},
                    "description": "Driver-specific settings validated by the selected service driver.",
                    "propertyNames": {
                      "pattern": "^[a-z][a-z0-9_-]*$"
                    },
                    "type": "object"
                  },
                  "version": {
                    "description": "Driver version or image tag to run.",
                    "examples": [
                      "17"
                    ]
                  },
                  "volumes": {
                    "description": "Additional driver-defined persistent volume names.",
                    "items": {
                      "description": "Expects lower-case letters, digits and hyphens, starting with a letter, at most 40 characters.",
                      "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$",
                      "type": "string"
                    },
                    "type": "array"
                  }
                },
                "type": "object"
              }
            ],
            "description": "Also accepts the version to run."
          },
          "description": "Supporting services managed outside application releases, such as databases and caches.",
          "type": "object"
        },
        "workloads": {
          "additionalProperties": {
            "additionalProperties": false,
            "allOf": [
              {
                "if": {
                  "required": [
                    "execution"
                  ]
                },
                "then": {
                  "not": {
                    "required": [
                      "compose"
                    ]
                  },
                  "properties": {
                    "dataEffect": {
                      "const": "None"
                    },
                    "deploymentPhase": {
                      "const": "None"
                    },
                    "operatorRun": {
                      "const": "Allowed"
                    }
                  },
                  "required": [
                    "schedule",
                    "dataEffect"
                  ]
                }
              },
              {
                "oneOf": [
                  {
                    "required": [
                      "build"
                    ]
                  },
                  {
                    "required": [
                      "image"
                    ]
                  },
                  {
                    "required": [
                      "compose"
                    ]
                  }
                ]
              },
              {
                "not": {
                  "allOf": [
                    {
                      "required": [
                        "publishedPorts"
                      ]
                    },
                    {
                      "anyOf": [
                        {
                          "properties": {
                            "strategy": {
                              "const": "Rolling"
                            }
                          },
                          "required": [
                            "strategy"
                          ]
                        },
                        {
                          "allOf": [
                            {
                              "not": {
                                "required": [
                                  "strategy"
                                ]
                              }
                            },
                            {
                              "required": [
                                "health"
                              ]
                            },
                            {
                              "anyOf": [
                                {
                                  "properties": {
                                    "role": {
                                      "const": "Application"
                                    }
                                  },
                                  "required": [
                                    "role"
                                  ]
                                },
                                {
                                  "not": {
                                    "required": [
                                      "role"
                                    ]
                                  }
                                }
                              ]
                            }
                          ]
                        }
                      ]
                    }
                  ]
                }
              },
              {
                "if": {
                  "properties": {
                    "persistence": {
                      "anyOf": [
                        {
                          "properties": {
                            "mode": {
                              "const": "Durable"
                            }
                          },
                          "required": [
                            "mode"
                          ]
                        },
                        {
                          "not": {
                            "required": [
                              "mode"
                            ]
                          }
                        }
                      ]
                    }
                  },
                  "required": [
                    "persistence"
                  ]
                },
                "then": {
                  "properties": {
                    "replicas": {
                      "maximum": 1
                    }
                  }
                }
              },
              {
                "else": {
                  "not": {
                    "anyOf": [
                      {
                        "required": [
                          "deploymentPhase"
                        ]
                      },
                      {
                        "required": [
                          "operatorRun"
                        ]
                      },
                      {
                        "required": [
                          "dataEffect"
                        ]
                      },
                      {
                        "required": [
                          "schedule"
                        ]
                      },
                      {
                        "required": [
                          "inputs"
                        ]
                      },
                      {
                        "required": [
                          "execution"
                        ]
                      }
                    ]
                  }
                },
                "if": {
                  "properties": {
                    "role": {
                      "const": "Job"
                    }
                  },
                  "required": [
                    "role"
                  ]
                },
                "then": {
                  "required": [
                    "dataEffect"
                  ]
                }
              }
            ],
            "properties": {
              "build": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "additionalProperties": false,
                    "description": "Build metadata for development. Production requires a resolved image supplied with --image.",
                    "properties": {
                      "args": {
                        "additionalProperties": {},
                        "description": "Build arguments supplied by the external build system.",
                        "type": "object"
                      },
                      "context": {
                        "description": "Repository-relative build context. Expects a path inside the repository, with no control character or shell metacharacter.",
                        "examples": [
                          "."
                        ],
                        "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                        "type": "string"
                      },
                      "dockerfile": {
                        "description": "Repository-relative Dockerfile path. Expects a path inside the repository, with no control character or shell metacharacter.",
                        "examples": [
                          "Dockerfile"
                        ],
                        "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                        "type": "string"
                      },
                      "target": {
                        "description": "Named Dockerfile stage to build.",
                        "type": "string"
                      }
                    },
                    "type": "object"
                  }
                ],
                "description": "Build metadata for development. Production requires a resolved image supplied with --image. Also accepts a build context path."
              },
              "command": {
                "anyOf": [
                  {
                    "anyOf": [
                      {
                        "type": "string"
                      },
                      {
                        "items": {
                          "type": "string"
                        },
                        "type": "array"
                      }
                    ]
                  },
                  {
                    "description": "Container command as a shell string or argument list.",
                    "examples": [
                      "./bin/server"
                    ]
                  }
                ],
                "description": "Container command as a shell string or argument list. Also accepts a command line or argument list."
              },
              "compose": {
                "description": "Existing Compose service to adopt, as repository path#service. Expects a reference of the form path/to/compose.yaml#service.",
                "examples": [
                  "docker-compose.yml#web"
                ],
                "pattern": "^[^/#][^#]*#[a-zA-Z0-9._-]+$",
                "type": "string"
              },
              "dataEffect": {
                "description": "Job data impact used by rollback and abort gates.",
                "enum": [
                  "None",
                  "Migration",
                  "Destructive",
                  "Unknown"
                ],
                "examples": [
                  "migration"
                ],
                "type": "string"
              },
              "deploymentPhase": {
                "default": "None",
                "description": "Deployment phase for this job: none, pre_release, or post_release.",
                "enum": [
                  "None",
                  "PreRelease",
                  "PostRelease"
                ],
                "type": "string"
              },
              "drain": {
                "additionalProperties": false,
                "description": "Signal and timing used to remove a container from traffic before stopping it.",
                "properties": {
                  "grace": {
                    "description": "Maximum graceful-shutdown time before forced termination, at most 7d. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                    "examples": [
                      "30s"
                    ],
                    "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                    "type": "string"
                  },
                  "signal": {
                    "default": "TERM",
                    "description": "Signal sent to begin graceful shutdown. Expects a signal name such as TERM or QUIT.",
                    "pattern": "^[A-Z][A-Z0-9]*$",
                    "type": "string"
                  },
                  "wait": {
                    "description": "Maximum drain window before shutdown continues, at most 7d. Recreate workloads continue sooner when every old container exits. Rolling workloads wait the full interval before stopping each container when their health check supports drain guarding. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                    "examples": [
                      "10s"
                    ],
                    "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "entrypoint": {
                "anyOf": [
                  {
                    "anyOf": [
                      {
                        "type": "string"
                      },
                      {
                        "items": {
                          "type": "string"
                        },
                        "type": "array"
                      }
                    ]
                  },
                  {
                    "description": "Container entrypoint as a string or argument list."
                  }
                ],
                "description": "Container entrypoint as a string or argument list. Also accepts an entrypoint or argument list."
              },
              "env": {
                "additionalProperties": {},
                "description": "Literal container environment values. Managed-service credential variables cannot be overridden.",
                "type": "object"
              },
              "envFiles": {
                "description": "Workload-specific ordered environment-file list. Replaces broader defaults when present.",
                "items": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "additionalProperties": false,
                      "properties": {
                        "file": {
                          "description": "Repository-relative environment file path. Expects a path inside the repository, with no control character or shell metacharacter.",
                          "examples": [
                            ".env.production"
                          ],
                          "pattern": "^[^/\\x00-\\x1f'\"$`\\\\][^\\x00-\\x1f'\"$`\\\\]*$",
                          "type": "string"
                        },
                        "provider": {
                          "description": "Decryptor used before staging the file. The supported encrypted provider is sops.",
                          "enum": [
                            "Sops"
                          ],
                          "examples": [
                            "sops"
                          ],
                          "type": "string"
                        }
                      },
                      "required": [
                        "file"
                      ],
                      "type": "object"
                    }
                  ],
                  "description": "Also accepts a path to an environment file."
                },
                "type": "array"
              },
              "execution": {
                "additionalProperties": false,
                "description": "Opt-in durable scheduled execution. Requires a native operator-runnable phase-none job with dataEffect None. Stores non-secret checkpoints on the host and permits explicit same-release resume.",
                "properties": {
                  "retention": {
                    "default": "168h",
                    "description": "Time from creation during which an unsuccessful execution may be resumed, at most 30d. Active executions remain protected. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                    "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                    "type": "string"
                  },
                  "steps": {
                    "description": "Optional ordered steps using this job's image and entrypoint. Omit to execute the job command as one step. At most 32 steps.",
                    "items": {
                      "additionalProperties": false,
                      "properties": {
                        "command": {
                          "description": "Argument vector passed to the job image's entrypoint. No shell evaluation is performed.",
                          "items": {
                            "type": "string"
                          },
                          "maxItems": 128,
                          "minItems": 1,
                          "type": "array"
                        },
                        "id": {
                          "description": "Unique stable step identifier, used by output references. Expects lower-case letters, digits and hyphens, starting with a letter, at most 40 characters.",
                          "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$",
                          "type": "string"
                        },
                        "inputs": {
                          "additionalProperties": {
                            "type": "string"
                          },
                          "description": "Environment variables populated from a preceding step's declared output, written as step.OUTPUT.",
                          "propertyNames": {
                            "pattern": "^[A-Z][A-Z0-9_]*$"
                          },
                          "type": "object"
                        },
                        "outputs": {
                          "description": "Required string keys in the JSON object written to ONEBOX_OUTPUT_FILE. Values are non-secret, at most 4096 bytes each and 16384 bytes total.",
                          "items": {
                            "description": "Expects upper-case letters, digits and underscores, starting with a letter.",
                            "pattern": "^[A-Z][A-Z0-9_]*$",
                            "type": "string"
                          },
                          "maxItems": 32,
                          "type": "array",
                          "uniqueItems": true
                        },
                        "retry": {
                          "additionalProperties": false,
                          "description": "Per-step retry policy; defaults to schedule.retry. All steps and backoff share the activation timeout.",
                          "properties": {
                            "attempts": {
                              "default": 1,
                              "description": "Total attempts including the first, 1 to 10.",
                              "examples": [
                                3
                              ],
                              "maximum": 10,
                              "minimum": 1,
                              "type": "integer"
                            },
                            "backoff": {
                              "default": "30s",
                              "description": "Sleep before the second attempt; it doubles after each failure. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                              "examples": [
                                "1m"
                              ],
                              "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                              "type": "string"
                            },
                            "maxBackoff": {
                              "default": "10m",
                              "description": "Upper bound for the doubling sleep. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                              "examples": [
                                "30m"
                              ],
                              "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                              "type": "string"
                            }
                          },
                          "type": "object"
                        }
                      },
                      "required": [
                        "id",
                        "command"
                      ],
                      "type": "object"
                    },
                    "maxItems": 32,
                    "type": "array"
                  }
                },
                "type": "object"
              },
              "extraHosts": {
                "description": "Additional host-to-address entries added to the container.",
                "items": {
                  "type": "string"
                },
                "type": "array"
              },
              "health": {
                "anyOf": [
                  {
                    "type": "string"
                  },
                  {
                    "additionalProperties": false,
                    "description": "Readiness check used to gate rolling replacement.",
                    "properties": {
                      "exec": {
                        "description": "Health command as a shell string or direct argument list."
                      },
                      "http": {
                        "description": "HTTP path probed inside the container. Expects a path beginning with /.",
                        "examples": [
                          "/healthz"
                        ],
                        "pattern": "^/[^\\x00-\\x1f'\"$` \\\\]*$",
                        "type": "string"
                      },
                      "interval": {
                        "default": "5s",
                        "description": "Delay between container health probes, at most 7d. Always written into the generated healthcheck, so the rollout's drain budget is computed from the value the container actually runs with. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                        "examples": [
                          "2s"
                        ],
                        "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                        "type": "string"
                      },
                      "port": {
                        "description": "Container port probed by HTTP or TCP health checks.",
                        "examples": [
                          8080
                        ],
                        "maximum": 65535,
                        "minimum": 1,
                        "type": "integer"
                      },
                      "retries": {
                        "default": 3,
                        "description": "Consecutive failed probes before the container is unhealthy. A draining container leaves rotation after this many probes, so it sets how long a rolling deploy waits for each replica.",
                        "examples": [
                          3
                        ],
                        "type": "integer"
                      },
                      "startPeriod": {
                        "default": "30s",
                        "description": "Startup grace period before failed probes count, at most 7d. Always written into the generated healthcheck, so writing down a fast probe interval does not call a booting container unhealthy. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                        "examples": [
                          "5s"
                        ],
                        "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                        "type": "string"
                      },
                      "tcp": {
                        "default": false,
                        "description": "Probe the configured port by opening a TCP connection.",
                        "type": "boolean"
                      },
                      "within": {
                        "description": "Maximum time a rollout waits for readiness, at most 7d. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                        "examples": [
                          "120s"
                        ],
                        "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                        "type": "string"
                      }
                    },
                    "type": "object"
                  }
                ],
                "description": "Readiness check used to gate rolling replacement. Also accepts an HTTP health path."
              },
              "hostname": {
                "description": "Hostname assigned inside the workload container.",
                "type": "string"
              },
              "image": {
                "anyOf": [
                  {
                    "description": "Expects a registry reference such as nginx:1.27 or ghcr.io/acme/app@sha256:….",
                    "pattern": "^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\\[(?:[a-fA-F0-9:]+)\\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\\w][\\w.-]{0,127}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}))?$",
                    "type": "string"
                  },
                  {
                    "additionalProperties": false,
                    "description": "Container image source, written as a reference string or an object.",
                    "examples": [
                      "ghcr.io/acme/shop:1.4.0"
                    ],
                    "properties": {
                      "pull": {
                        "default": "Missing",
                        "description": "When to fetch the image from the registry: missing fetches only what the host does not already hold, always fetches every release, never fetches at all and fails on a missing image.",
                        "enum": [
                          "Always",
                          "Missing",
                          "Never"
                        ],
                        "type": "string"
                      },
                      "reference": {
                        "description": "Complete container image reference, optionally tagged or digest-pinned. Expects a registry reference such as nginx:1.27 or ghcr.io/acme/app@sha256:….",
                        "examples": [
                          "ghcr.io/acme/shop:1.4.0"
                        ],
                        "pattern": "^((?:(?:(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9])(?:\\.(?:[a-zA-Z0-9]|[a-zA-Z0-9][a-zA-Z0-9-]*[a-zA-Z0-9]))*|\\[(?:[a-fA-F0-9:]+)\\])(?::[0-9]+)?/)?[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*(?:/[a-z0-9]+(?:(?:[._]|__|[-]+)[a-z0-9]+)*)*)(?::([\\w][\\w.-]{0,127}))?(?:@([A-Za-z][A-Za-z0-9]*(?:[-_+.][A-Za-z][A-Za-z0-9]*)*[:][[:xdigit:]]{32,}))?$",
                        "type": "string"
                      }
                    },
                    "type": "object"
                  }
                ],
                "description": "Container image source, written as a reference string or an object. Also accepts an image reference."
              },
              "init": {
                "description": "Run a minimal init process as PID 1 inside the container.",
                "type": "boolean"
              },
              "inputs": {
                "additionalProperties": {
                  "additionalProperties": false,
                  "oneOf": [
                    {
                      "required": [
                        "enum"
                      ]
                    },
                    {
                      "required": [
                        "pattern"
                      ]
                    }
                  ],
                  "properties": {
                    "default": {
                      "description": "Value used by a timer firing and by an operator run that does not override it. Must satisfy the input's own constraint.",
                      "type": "string"
                    },
                    "description": {
                      "description": "What the input controls.",
                      "type": "string"
                    },
                    "enum": {
                      "description": "Accepted values.",
                      "examples": [
                        [
                          "catalog"
                        ]
                      ],
                      "items": {
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "pattern": {
                      "description": "Regular expression the whole value must match.",
                      "examples": [
                        "^[0-9]{4}-[0-9]{2}-[0-9]{2}$"
                      ],
                      "type": "string"
                    }
                  },
                  "required": [
                    "default"
                  ],
                  "type": "object"
                },
                "description": "Declared parameters of a scheduled job, exposed as environment variables. Names are upper-case identifiers; each declares exactly one of enum or pattern and a default. A timer firing uses the defaults; ob job run may override them.",
                "propertyNames": {
                  "pattern": "^[A-Z][A-Z0-9_]*$"
                },
                "type": "object"
              },
              "labels": {
                "additionalProperties": {},
                "description": "Additional container labels outside namespaces reserved by Onebox and the proxy.",
                "type": "object"
              },
              "logging": {
                "additionalProperties": false,
                "description": "Container logging driver and driver-specific options.",
                "properties": {
                  "driver": {
                    "description": "Container runtime logging driver. Expects a log driver name such as local, json-file or an org/plugin:tag.",
                    "examples": [
                      "local"
                    ],
                    "pattern": "^[a-z0-9][a-z0-9_.-]*(/[a-z0-9][a-z0-9_.-]*)?(:[A-Za-z0-9_.-]+)?$",
                    "type": "string"
                  },
                  "options": {
                    "additionalProperties": {},
                    "description": "Driver-specific logging options passed to the container runtime.",
                    "propertyNames": {
                      "pattern": "^[a-z][a-z0-9_.-]*$"
                    },
                    "type": "object"
                  }
                },
                "type": "object"
              },
              "needs": {
                "description": "Workload or supporting-service prerequisites and optional connection-variable mappings.",
                "items": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "additionalProperties": false,
                      "properties": {
                        "condition": {
                          "description": "Prerequisite condition: started, healthy, or completed.",
                          "enum": [
                            "Started",
                            "Healthy",
                            "Completed"
                          ],
                          "type": "string"
                        },
                        "env": {
                          "additionalProperties": {
                            "type": "string"
                          },
                          "description": "Maps application environment-variable names to service connection parts such as host, port, user, password, database, or url.",
                          "type": "object"
                        },
                        "name": {
                          "description": "Name of a workload or supporting service that must start first. Expects lower-case letters, digits and hyphens, starting with a letter, at most 40 characters.",
                          "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$",
                          "type": "string"
                        }
                      },
                      "type": "object"
                    }
                  ],
                  "description": "Also accepts the name of a prerequisite."
                },
                "type": "array"
              },
              "operatorRun": {
                "description": "Whether an operator may invoke this job outside deployment: allowed or disabled. Defaults to allowed for phase none and disabled otherwise.",
                "enum": [
                  "Allowed",
                  "Disabled"
                ],
                "type": "string"
              },
              "persistence": {
                "additionalProperties": false,
                "description": "Declares whether this workload holds data that must outlive releases.",
                "properties": {
                  "mode": {
                    "default": "Durable",
                    "description": "Data lifetime: durable, ephemeral, or external.",
                    "enum": [
                      "Durable",
                      "Ephemeral",
                      "External"
                    ],
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "port": {
                "description": "Default container port used by HTTP health checks.",
                "examples": [
                  3000
                ],
                "maximum": 65535,
                "minimum": 1,
                "type": "integer"
              },
              "publishedPorts": {
                "description": "Host ports published outside the proxy. They bind to loopback by default. A rolling workload cannot publish one, because two replicas cannot hold the same host port during a roll: set strategy: recreate, or route through the proxy instead.",
                "items": {
                  "additionalProperties": false,
                  "properties": {
                    "bind": {
                      "default": "127.0.0.1",
                      "description": "Host address on which the published port listens.",
                      "type": "string"
                    },
                    "container": {
                      "description": "Port receiving traffic inside the container.",
                      "examples": [
                        3000
                      ],
                      "maximum": 65535,
                      "minimum": 1,
                      "type": "integer"
                    },
                    "host": {
                      "description": "Port exposed on the host.",
                      "examples": [
                        8080
                      ],
                      "maximum": 65535,
                      "minimum": 1,
                      "type": "integer"
                    },
                    "protocol": {
                      "default": "tcp",
                      "description": "Published transport protocol: tcp or udp.",
                      "enum": [
                        "tcp",
                        "udp"
                      ],
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": "array"
              },
              "replicas": {
                "default": 1,
                "description": "Desired number of long-running workload containers.",
                "examples": [
                  2
                ],
                "minimum": 1,
                "type": "integer"
              },
              "resources": {
                "additionalProperties": false,
                "description": "Container memory and CPU limits.",
                "properties": {
                  "cpus": {
                    "description": "Container CPU limit expressed as a positive decimal count. Expects a number of CPUs such as 0.5 or 2.",
                    "examples": [
                      "0.5"
                    ],
                    "pattern": "^[0-9]+(\\.[0-9]+)?$",
                    "type": "string"
                  },
                  "memory": {
                    "description": "Container memory limit. Expects a size such as 512MB or 1.5GB.",
                    "examples": [
                      "512MB"
                    ],
                    "pattern": "^[0-9]+(\\.[0-9]+)?(B|KB|MB|GB|TB)$",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "role": {
                "description": "Lifecycle role: application, worker, daemon, or job.",
                "enum": [
                  "Application",
                  "Worker",
                  "Daemon",
                  "Job"
                ],
                "examples": [
                  "application"
                ],
                "type": "string"
              },
              "routes": {
                "description": "Ingress routes exposed by this workload.",
                "items": {
                  "additionalProperties": false,
                  "allOf": [
                    {
                      "if": {
                        "properties": {
                          "hostname": {
                            "const": "*"
                          }
                        },
                        "required": [
                          "hostname"
                        ]
                      },
                      "then": {
                        "properties": {
                          "protocol": {
                            "const": "tcp"
                          },
                          "tls": {
                            "enum": [
                              "None",
                              "Passthrough"
                            ]
                          }
                        },
                        "required": [
                          "protocol",
                          "tls"
                        ]
                      }
                    },
                    {
                      "if": {
                        "properties": {
                          "hostname": {
                            "pattern": "^\\*\\."
                          }
                        },
                        "required": [
                          "hostname"
                        ]
                      },
                      "then": {
                        "properties": {
                          "protocol": {
                            "const": "http"
                          }
                        }
                      }
                    },
                    {
                      "if": {
                        "properties": {
                          "tls": {
                            "const": "Passthrough"
                          }
                        },
                        "required": [
                          "tls"
                        ]
                      },
                      "then": {
                        "properties": {
                          "protocol": {
                            "const": "tcp"
                          }
                        },
                        "required": [
                          "protocol"
                        ]
                      }
                    }
                  ],
                  "properties": {
                    "entrypoint": {
                      "default": "websecure",
                      "description": "Named proxy listener used for the route.",
                      "type": "string"
                    },
                    "hostname": {
                      "anyOf": [
                        {
                          "maxLength": 253,
                          "pattern": "^(\\*\\.)?[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?(\\.[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?)*$"
                        },
                        {
                          "const": "*"
                        }
                      ],
                      "description": "Hostname matched by the proxy. Accepts an exact hostname or a wildcard in the complete left-most label, such as *.example.com; a wildcard matches exactly one label and not the suffix itself. The bare * value is reserved for plaintext or TLS-passthrough TCP catch-all routes.",
                      "examples": [
                        "shop.example.com"
                      ],
                      "type": "string"
                    },
                    "middlewares": {
                      "description": "Ordered provider-qualified middleware references applied to this route.",
                      "items": {
                        "description": "Expects a provider-qualified name such as secure-headers@file.",
                        "pattern": "^[A-Za-z0-9][A-Za-z0-9_.-]*@[a-z][a-z0-9-]*$",
                        "type": "string"
                      },
                      "type": "array"
                    },
                    "path": {
                      "default": "/",
                      "description": "URL path prefix matched by an HTTP route. Expects a path beginning with /.",
                      "pattern": "^/[^\\x00-\\x1f'\"$` \\\\]*$",
                      "type": "string"
                    },
                    "port": {
                      "description": "Container port receiving routed traffic.",
                      "examples": [
                        3000
                      ],
                      "maximum": 65535,
                      "minimum": 1,
                      "type": "integer"
                    },
                    "protocol": {
                      "default": "http",
                      "description": "Routing protocol: http or tcp.",
                      "enum": [
                        "http",
                        "tcp"
                      ],
                      "type": "string"
                    },
                    "scheme": {
                      "default": "http",
                      "description": "Backend connection scheme for HTTP routes: http, https, or h2c.",
                      "enum": [
                        "http",
                        "https",
                        "h2c"
                      ],
                      "type": "string"
                    },
                    "tls": {
                      "default": "Terminate",
                      "description": "TLS handling: terminate, passthrough, or none.",
                      "enum": [
                        "Terminate",
                        "Passthrough",
                        "None"
                      ],
                      "type": "string"
                    }
                  },
                  "required": [
                    "hostname"
                  ],
                  "type": "object"
                },
                "type": "array"
              },
              "schedule": {
                "additionalProperties": false,
                "description": "Host-resident recurring schedule and run policy for a job, independent of its deployment phase and operator-run policy.",
                "properties": {
                  "catchUp": {
                    "default": true,
                    "description": "Run once after the host returns if an elapsed schedule was missed while it was offline.",
                    "type": "boolean"
                  },
                  "cron": {
                    "description": "Five-field cron schedule translated to a host timer. Expects five cron fields.",
                    "examples": [
                      "0 2 * * *"
                    ],
                    "pattern": "^[-0-9*/,A-Za-z ]+$",
                    "type": "string"
                  },
                  "deployLock": {
                    "default": "Exclusive",
                    "description": "Deployment coordination policy: exclusive blocks application operations for the full run; pinned leases the immutable starting release and permits only deployments without data-changing jobs or untyped hooks.",
                    "enum": [
                      "Exclusive",
                      "Pinned"
                    ],
                    "examples": [
                      "pinned"
                    ],
                    "type": "string"
                  },
                  "notify": {
                    "default": [
                      "failure",
                      "timeout"
                    ],
                    "description": "Run outcomes that send the configured notifications: success, failure, timeout, skipped.",
                    "items": {
                      "enum": [
                        "Success",
                        "Failure",
                        "Timeout",
                        "Skipped"
                      ],
                      "type": "string"
                    },
                    "type": "array"
                  },
                  "retry": {
                    "additionalProperties": false,
                    "description": "Bounded retry inside one timer firing. Attempts run under the same locks and the same timeout; a timeout ends the run.",
                    "properties": {
                      "attempts": {
                        "default": 1,
                        "description": "Total attempts including the first, 1 to 10.",
                        "examples": [
                          3
                        ],
                        "maximum": 10,
                        "minimum": 1,
                        "type": "integer"
                      },
                      "backoff": {
                        "default": "30s",
                        "description": "Sleep before the second attempt; it doubles after each failure. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                        "examples": [
                          "1m"
                        ],
                        "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                        "type": "string"
                      },
                      "maxBackoff": {
                        "default": "10m",
                        "description": "Upper bound for the doubling sleep. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                        "examples": [
                          "30m"
                        ],
                        "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                        "type": "string"
                      }
                    },
                    "type": "object"
                  },
                  "shutdownGrace": {
                    "default": "30s",
                    "description": "Time allowed for graceful container shutdown after the run deadline before Onebox forces removal. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                    "examples": [
                      "45s"
                    ],
                    "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                    "type": "string"
                  },
                  "timeout": {
                    "default": "1h",
                    "description": "Maximum wall time for one scheduled run before systemd terminates it and records failure. Expects a duration such as 30s, 5m, 1h30m or 14d.",
                    "examples": [
                      "30m"
                    ],
                    "pattern": "^(([0-9]+([.][0-9]+)?(ns|us|µs|ms|s|m|h))+|[0-9]+d)$",
                    "type": "string"
                  },
                  "timezone": {
                    "default": "UTC",
                    "description": "IANA timezone used to interpret the cron schedule. Expects an IANA zone name such as UTC or Europe/Berlin.",
                    "examples": [
                      "Europe/Berlin"
                    ],
                    "pattern": "^[A-Za-z][A-Za-z0-9_+-]*(/[A-Za-z0-9_+-]+)*$",
                    "type": "string"
                  }
                },
                "type": "object"
              },
              "stdinOpen": {
                "description": "Keep standard input open for the container.",
                "type": "boolean"
              },
              "strategy": {
                "description": "Replacement strategy for a changed or uncertain workload. An unchanged healthy workload is retained automatically. Defaults to rolling only for an application workload with health; all other workloads default to recreate.",
                "enum": [
                  "Rolling",
                  "Recreate"
                ],
                "type": "string"
              },
              "tty": {
                "description": "Allocate a pseudo-TTY for the container.",
                "type": "boolean"
              },
              "user": {
                "description": "User or UID used to run the container process.",
                "type": "string"
              },
              "volumes": {
                "description": "Managed named volumes or bind mounts. Relative bind sources are read-only release content; absolute sources are external host state.",
                "items": {
                  "additionalProperties": false,
                  "allOf": [
                    {
                      "if": {
                        "properties": {
                          "source": {
                            "pattern": "^[^/]"
                          }
                        },
                        "required": [
                          "source"
                        ]
                      },
                      "then": {
                        "properties": {
                          "mode": {
                            "const": "Ro"
                          }
                        },
                        "required": [
                          "mode"
                        ]
                      }
                    }
                  ],
                  "anyOf": [
                    {
                      "required": [
                        "name",
                        "path"
                      ]
                    },
                    {
                      "required": [
                        "source",
                        "path"
                      ]
                    }
                  ],
                  "properties": {
                    "mode": {
                      "default": "Rw",
                      "description": "Mount access mode: rw or ro. A relative bind source requires ro.",
                      "enum": [
                        "Rw",
                        "Ro"
                      ],
                      "type": "string"
                    },
                    "name": {
                      "description": "Stable logical name of a Onebox-managed volume. Expects lower-case letters, digits and hyphens, starting with a letter, at most 40 characters.",
                      "examples": [
                        "data"
                      ],
                      "pattern": "^[a-z]([a-z0-9-]{0,38}[a-z0-9])?$",
                      "type": "string"
                    },
                    "path": {
                      "description": "Absolute container path where the volume or bind mount is attached. Expects an absolute path with no control character or shell metacharacter.",
                      "examples": [
                        "/var/lib/app"
                      ],
                      "pattern": "^/[^\\x00-\\x1f'\"$`\\\\]*$",
                      "type": "string"
                    },
                    "source": {
                      "description": "Bind mount source. An absolute path is external host state that outlives releases. A dot-prefixed repository path is read-only release content, kept for as long as a container still mounts it. Expects an absolute host path or a dot-prefixed path inside the repository, with no colon, control character or shell metacharacter.",
                      "examples": [
                        "./config"
                      ],
                      "not": {
                        "pattern": "(^|/)\\.\\.(/|$)"
                      },
                      "pattern": "^(/[^\\x00-\\x1f'\"$`\\\\:]*|\\.(?:/[^\\x00-\\x1f'\"$`\\\\:]*)?)$",
                      "type": "string"
                    }
                  },
                  "type": "object"
                },
                "type": "array"
              },
              "workingDir": {
                "description": "Absolute working directory for the container process. Expects an absolute path with no control character or shell metacharacter.",
                "examples": [
                  "/app"
                ],
                "pattern": "^/[^\\x00-\\x1f'\"$`\\\\]*$",
                "type": "string"
              }
            },
            "type": "object"
          },
          "description": "Application containers, workers, daemons, and jobs managed as releases.",
          "minProperties": 1,
          "type": "object"
        }
      },
      "required": [
        "environments",
        "workloads"
      ],
      "type": "object"
    }
  },
  "required": [
    "apiVersion",
    "kind",
    "metadata",
    "spec"
  ],
  "title": "Onebox Application (onebox.run/v1alpha1)",
  "type": "object"
}