[shipmill-romamo]

Summary

A Domain can declare spec.routes (spec S-003): proxy routes (path + upstream {address, port}) and static routes (path + static {component, directory, spaFallback?}), exactly one of upstream or static per route. This PR is the schema, the parser and cloudfall config validate; rendering is #162.

• config/schemas/v1/domain.schema.json: routes (at least one item) with $defs for the route, the upstream (now shared with proxy.upstream, same shape) and the release-relative path. directory and spaFallback are held by the schema: letters, digits and ._-/, relative, no .. segment, and directory not the release root (., ./, ././). path is only a string in the schema, so its rules refuse with their own codes
• sdk/src/cloudfall/domain.py: DomainRoutePath (/ then letters, digits and ._~/-; is_reserved, is_directory) and ReleaseRelativePath (is_release_root)
• sdk/src/cloudfall/inventory.py: DomainProxyRoute, DomainStaticRoute, DomainInventory.routes (default empty). as_dict() adds routes only when there are some, so a Domain with only proxy.upstream serializes byte-for-byte as before (Q-3)
• sdk/src/cloudfall/validation.py: _validate_domain_references checks routes in this order: domain_route_source_invalid (both proxy.upstream and routes; neither stays valid), domain_route_path_invalid, domain_route_path_reserved (/.well-known/acme-challenge or under it), domain_route_path_duplicate, then for a static route the trailing / (domain_route_path_invalid), resource_reference_missing and domain_route_component_not_on_proxy. Every refusal exits CONFIG_INVALID

The engine needs no change for CI: config/examples has no routes, and domains.yml's early check already refuses a Domain without proxy.upstream before any change, so a routes-only Domain stops there until #162.

Plan

• Serves: G-3
• Files: config/schemas/v1/domain.schema.json, sdk/src/cloudfall/domain.py, sdk/src/cloudfall/inventory.py, sdk/src/cloudfall/validation.py, sdk/tests/test_domain_routes.py, changelog.d/159-domain-routes-validation.md
• Order: failing tests for each criterion first (sdk/tests/test_domain_routes.py); then the routes schema, the route value objects, DomainInventory.routes, and the _validate_domain_references route checks; the spec's Behaviour covers the rules
• Proof: S-003-1, S-003-8, S-003-9, S-003-10, S-003-11, S-003-12, each a test_s003_<k>_... test running cloudfall config validate; the existing inventory and validation tests prove a Domain with only proxy.upstream is unchanged (Q-3)

Test plan

• New sdk/tests/test_domain_routes.py (28 tests), failing on main at import, passing here; specs.py coverage --spec 003 lists a test for each of S-003-1, 8, 9, 10, 11, 12
• uv run ruff check ., uv run mypy, uv run cloudfall config validate --project config/examples: pass
• Touched and domain-related tests pass (165): sdk/tests/test_validation.py, test_inventory.py, test_domains_apply.py, test_domains_converge.py, test_domains_observe.py, test_service_evidence.py, test_operations_dashboard.py, test_agent_server.py, engine/tests/test_nginx_site_templates.py, test_domains_one_domain.py, test_ansible_inventory.py
• The full suite is left to CI

Fixes #159
Part of #90

🤖 Generated with Claude Code