Takoform portable specification

This directory is the portable specification surface for Takoform, an Experimental specification and tooling project. Takoform defines a small desired-state boundary between infrastructure-as-code clients and resource hosts; it is not currently an industry standard, certification authority, or guarantee of backend portability.

Requirement keywords, conformance classes, and what a passing check does and does not prove are defined in conformance.md. How the API group, Forms, packages, and the provider are versioned is in versioning.md. Current project positioning and the Proposal → Experimental → Stable → Legacy lifecycle are defined in project-lifecycle.md. The exact boundary between portable workload semantics and host/profile/operator concerns is portability-boundary.md.

Product contract map

Takoform has four public contract interfaces:

1. Exact Form and Package data.form-definition/ defines immutable FormRef and the desired/observed/output shape. form-package/ binds one exact definition and its data-only fixtures into immutable package bytes.
2. Desired Resource lifecycle.host-api/ defines discovery, exact Form availability, preview/apply, read/import/observe/refresh/delete, fencing, and portable errors. The host chooses implementation and placement.
3. Read-only Form-derived Interface projection.interface-declaration/ defines open (name, version) descriptors embedded in Forms and their read-only host projection. Focused contracts such as data.indexed@1 only define the descriptor data the current Form actually declares.
4. Trust, lifecycle, version, and release identity.trust/ defines immutable publisher evidence and revocation; project-lifecycle.md separates Form maturity from Host Support and availability; versioning.md keeps provider, API, Form, and package compatibility independent. release/ binds artifacts to those exact identities without changing the three contracts above.

schemas/, conformance.md, and decisions/ support those interfaces with structural minima, executable evidence language, and decision rationale. They are not additional product interfaces. The generated current inventory is ../forms/README.md, host discovery validation is ../schemas/host-discovery.schema.json, and the local evidence map is ../conformance/README.md.

Current status

The FormRef, Form Definition, package-index, revocation, and cumulative revocation-checkpoint schemas, the RFC 8785/I-JSON library, the closed local verifier, the positive/negative corpus, the protected keyless Sigstore release lane, and the signed append-only checkpoint delivery lane are implemented.

The current Form epoch is forms.takoform.com/v1alpha2. ../forms/README.md is generated from its exact nine Proposal-derived, unpublished 0.1.0 source candidates targeting Experimental admission. Current packages use packages.forms.takoform.com/v1alpha3; provider v2 carries that line only as an unpublished source candidate. A repository implementation or local passing gate is not Form publication, Host Support, activation, or live Cloud availability.

Decision 0004 made the previously published forms.takoform.com/v1alpha1 line Legacy after it was labelled standard without sufficient independent implementation and operational evidence. Decision 0006 restarts selected kinds in the distinct v1alpha2 epoch through mutable Proposals and Experimental 0.x Forms. Decision 0007 requires those candidates to be independently authored and excludes substrate operation from portable desired state. Historical standard and portable-standard fields remain readable in immutable documents; they do not define a current approved subset. The lifecycle projection and Legacy verification tooling are implemented and fail closed against ../forms/lifecycle.json. Generated compatibility inventory pages classify every retained entry as Legacy and MUST NOT reinterpret historical package or admission fields as current project status.

Published generations are retained, not erased. Their immutable releases and admission evidence stay verifiable offline through ../forms/retired-package-set.json, and the current retained release sets. This build refuses to overwrite or restamp their proofs with a new provider or maturity identity.

The frozen Legacy Host API wire remains forms.takoform.com/v1alpha1. The current Host API wire and exact FormRef group are both forms.takoform.com/v1alpha2, reached through a separate versioned discovery path /.well-known/takoform/v1alpha2 so Legacy clients cannot select the current API accidentally. The Host API group is a protocol compatibility identity even when it currently has the same token as the nested Form epoch. The current package envelope is packages.forms.takoform.com/v1alpha3. The Terraform provider identity is registry.terraform.io/tako0614/takoform; its SemVer is independent from all three API identities.

Normative consistency audit

go test ./spec is the cross-specification contradiction gate. It does not repeat the Form Package verifier, provider schema tests, or portable-host runner. Instead, it joins their machine-readable inputs and fails when:

• host operations, mutation fences, idempotency, or the stable error taxonomy disagree with the portable-host conformance contract;
• the optional Interface projection stops being read-only, same-origin, and materialized only from Form-declared descriptors;
• the portable API identity, provider candidate version, or canonical provider FQN diverges between release, schema, trust, and conformance locks; or
• a normative active Form, package, schema, or host contract leaks a concrete backend vocabulary such as Cloudflare/Workers configuration.

The complete repository gate, bun run check, runs this audit together with the deeper package-byte, provider-schema, generated-surface, and lifecycle verifiers. Passing it remains local evidence only; it does not prove Registry publication, Host Support, Form maturity, production activation, or interoperability.