bascule-workspace/proto/bascule/v1/command.proto
Tyler King b1865a0627 initial: bascule v0.1.0
Bascule shell runtime workspace — governed shell access layer
for Substrate/Guildhouse FFC deployments.

Crates:
- bascule-agent: node agent with SSH server + command filtering
- bascule-core: audit, grant engine, ceremony types, session
- bascule-filter-core: log line filtering (stdio protocol)
- bascule-gateway: OIDC auth, session management, SAT validation
- bascule-node-agent: k8s DaemonSet agent (pod watcher, BPF manager)
- bascule-proto: protobuf definitions
- bascule-shell: governed SSH shell (commands, elevation, REPL)
- bascule-tail: chronicle log tail + fanout
- ceremony-engine: ceremony lifecycle (6 types + request/resolution)

172 tests passing.
Implements SBS-SPEC-0001 shell model.
Reference impl for SPEC-SHELLOPS-0001 Layer 1 (root shell).
2026-03-18 16:40:48 -04:00

82 lines
1.6 KiB
Protocol Buffer

syntax = "proto3";
package bascule.v1;
import "google/protobuf/struct.proto";
// --- Command execution ---
message ExecuteCommandRequest {
string session_id = 1;
string verb = 2;
optional string namespace = 3;
optional string resource_type = 4;
optional string resource_name = 5;
google.protobuf.Struct parameters = 6;
string output_format = 7;
}
message ExecuteCommandResponse {
bool allowed = 1;
string denied_reason = 2;
oneof result {
CommandResult success = 3;
CommandError error = 4;
}
AuditRef audit = 5;
}
message CommandResult {
string output = 1;
uint32 resources_affected = 2;
bool session_expired_warning = 3;
}
message CommandError {
string message = 1;
string code = 2;
}
// --- Streaming ---
message CommandStreamChunk {
oneof chunk {
string output_line = 1;
string error_line = 2;
bool eof = 3;
}
}
// --- Audit reference ---
message AuditRef {
string event_id = 1;
string classification = 2;
bool notarized = 3;
}
// --- Command discovery ---
message DiscoverCommandsRequest {
string session_id = 1;
}
message DiscoverCommandsResponse {
repeated CommandDescriptor commands = 1;
}
message CommandDescriptor {
string verb = 1;
string description = 2;
string classification = 3;
repeated ParameterDescriptor parameters = 4;
bool requires_namespace = 5;
bool requires_resource = 6;
bool streaming = 7;
}
message ParameterDescriptor {
string name = 1;
string description = 2;
string param_type = 3;
bool required = 4;
}