version: 1
kind: controlled_action
notes:
  - Write exactly one JSON object to /control/outbox/<action_id>.json by calling request_controlled_action.
  - Use only normalized guest paths under approved prefixes.
  - Do not invent host paths, shell commands, URLs, or extra fields.
  - Fields outside this schema are rejected by host validation.
required_fields:
  action_id:
    type: string
    pattern: "^act-[a-z0-9_-]{1,80}$"
  request_id:
    type: string
    pattern: "^req-[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$"
  requested_by:
    type: string
    pattern: "^[a-z][a-z0-9_-]{0,31}$"
  requested_for:
    type: string
    pattern: "^[a-z][a-z0-9_-]{0,31}$"
  action_type:
    enum:
      - run_real_data
      - release_results
  summary:
    type: string
    min_length: 1
    max_length: 240
  reason:
    type: string
    min_length: 1
    max_length: 1200
  input_path:
    type: guest_path
  output_path:
    type: guest_path
optional_fields:
  script_path:
    type: guest_path
  message_path:
    type: guest_path
  manifest_path:
    type: guest_path
  notification_path:
    type: guest_path
  supporting_paths:
    type: list
    max_items: 8
    item_type: guest_path
  template_vars:
    type: list
    max_items: 8
    item_type:
      name:
        pattern: "^[a-z][a-z0-9_]{0,31}$"
      value:
        min_length: 1
        max_length: 240
guest_path_rules:
  allowed_prefixes:
    - /input/
    - /output/
    - /messages/
    - /tool-templates/
    - /results/
    - /release/
action_specific_rules:
  run_real_data:
    requires:
      - script_path
  release_results:
    requires:
      - manifest_path
      - notification_path
