[shipmill-romamo]

Summary

Adds the S-002 build contract to the Component schema and the SDK model, and makes cloudfall config validate enforce it. Running the steps in artifact build is #115 and out of scope here.

• config/schemas/v1/component.schema.json: optional spec.buildTools (bare tool name to a dotted numeric minimum version), spec.build (ordered steps: workingDirectory with the same relative, no-.. rule as repository.subdirectory; command as an argv list of non-empty strings, never a shell string; optional timeoutSeconds 1..3600, default 900) and spec.artifact.include (unique relative paths, same rule). dependentRequired makes buildTools and artifact require build
• sdk/src/cloudfall/domain.py: value objects RelativeRepositoryPath, BuildToolName, BuildToolVersion, BuildCommand, BuildTimeoutSeconds that enforce the same rules as the schema
• sdk/src/cloudfall/inventory.py: ComponentBuild, ComponentBuildStep, ComponentBuildTool, and ComponentInventory.build (None without build). as_dict() adds buildTools, build and artifact only when build is declared, so inventory output for existing Components is unchanged
• sdk/src/cloudfall/validation.py: a step whose command[0] is not a key of buildTools fails with component_build_tool_undeclared and the field spec.build.<i>.command.0. Absolute or .. paths and buildTools/artifact without build fail in the schema as schema_validation_failed

Example configs and existing Components are untouched; config validate --project config/examples still passes with the same counts.

Test plan

• uv run pytest sdk/tests/test_component_build_validation.py sdk/tests/test_validation.py sdk/tests/test_inventory.py engine/tests/test_artifact_builder.py engine/tests/test_ansible_inventory.py: 50 passed
• uv run ruff check ., uv run mypy, uv run cloudfall config validate --project config/examples: clean
• Full suite left to CI

Fixes #113

Plan

• Serves: quality bar
• Files: config/schemas/v1/component.schema.json, sdk/src/cloudfall/domain.py, sdk/src/cloudfall/inventory.py, sdk/src/cloudfall/validation.py, sdk/tests/test_component_build_validation.py, changelog.d/113-component-build-validation.md
• Order: tests for S-002-1 and S-002-11 first; then the schema, the value objects and the inventory model; then the semantic command[0] check in validation
• Proof: S-002-1 (test_s002_1_*), S-002-11 (test_s002_11_*) in sdk/tests/test_component_build_validation.py

🤖 Generated with Claude Code

[shipmill-romamo]

@romamo Decided without waiting: the Component build-step validation adds the error code component_build_tool_undeclared, and refuses bad paths and a buildTools or artifact without build through the schema's generic schema_validation_failed.

Why: S-002-11 asks for the refusals but names no codes; a dedicated code only where the schema can't express the rule (a step's tool missing from buildTools). Review added a schema rule so tabs and trailing newlines are refused at validate instead of crashing the inventory build.
Not taken: a dedicated code per refusal, which would mean more codes for agents to learn with no extra information.

Reply with a comment starting with veto before 2026-10-28 08:45 UTC to reverse it, adding what you want instead if you like. A later veto still counts and gets a follow-up.