From d09e9cc51350786a30e02b11185bff87124c4a19 Mon Sep 17 00:00:00 2001
From: rldyourmnd <danil@nddev.it.com>
Date: Thu, 20 Aug 2026 12:21:01 +0500
Subject: [PATCH] chore(gds): declare public module identity

Signed-off-by: rldyourmnd <danil@nddev.it.com>
---
 .gds/repository.yaml            | 68 +++++++++++++++++++++++++++++++++
 docs/observability-v1alpha1.md  |  2 +-
 observability/redaction_test.go |  2 +-
 3 files changed, 70 insertions(+), 2 deletions(-)
 create mode 100644 .gds/repository.yaml

diff --git a/.gds/repository.yaml b/.gds/repository.yaml
new file mode 100644
index 0000000..c4d3c0a
--- /dev/null
+++ b/.gds/repository.yaml
@@ -0,0 +1,68 @@
+schema_version: 1
+
+repository:
+  id: "repo_01M0EZ7TQ2V3D1DBBFM0RM0E13"
+  display_name: "agent-runtime"
+  roles: ["project", "module"]
+  lifecycle: "active"
+
+provider:
+  type: "github"
+  installation: "installation:github-opennetwork"
+  repository_id: 1335304680
+  owner: "NDDev-OpenNetwork"
+  name: "agent-runtime"
+
+classification:
+  portfolios: ["portfolio:opennetwork-projects"]
+  visibility_contract: "public"
+  data_classification: "public"
+
+product:
+  purpose: "Versioned Task, Goal and lifecycle observability contracts for agent runtimes."
+  capabilities:
+    - "Bounded Task manifests"
+    - "Durable Goal journals"
+    - "Typed lifecycle events"
+  entrypoints:
+    - change: "Task manifest and runner implementation"
+      path: "manifest.go"
+    - change: "Durable Goal journal"
+      path: "goal"
+    - change: "Lifecycle observability"
+      path: "observability"
+    - change: "Public schemas"
+      path: "schemas"
+
+policy:
+  profiles: ["repository-default", "public-module", "agent-runtime"]
+  rollout_ring: "standard"
+
+git:
+  default_branch: "main"
+  integration: "pull-request"
+  branch_model: "task-branches"
+  handoff_pr: "preferred"
+  cleanup: "merged-only"
+
+verification:
+  commands:
+    lint: ["go vet ./..."]
+    test: ["go test -race ./..."]
+    build: ["go build ./cmd/agent-runtime"]
+  required: ["lint", "test", "build"]
+
+agent:
+  context_profile: "project-default"
+  generated_agents: false
+  serena: {enabled: false, provenance_required: false}
+
+module:
+  contract: "public"
+  consumption: ["package", "git-submodule"]
+  compatibility: "semver"
+  pin_policy: "version-tag"
+  publication: {registry: "none", github_release: "required"}
+
+release:
+  mode: "bundle"
diff --git a/docs/observability-v1alpha1.md b/docs/observability-v1alpha1.md
index 3bbed9e..15e5574 100644
--- a/docs/observability-v1alpha1.md
+++ b/docs/observability-v1alpha1.md
@@ -53,7 +53,7 @@ environment/provider content, credentials, tokens, and URLs.
 Redaction is driven by that vocabulary, not by inspecting a value for the shape
 of a secret. An attribute named `private_key`, `secret`, `token`, `password` or
 `credential` is redacted whatever it holds; an attribute named `note` or
-`payload` is published whatever it holds. `-----BEGIN OPENSSH PRIVATE KEY-----`
+`payload` is published whatever it holds. An OpenSSH private-key PEM header
 carried under a neutral name reaches the sink verbatim, with an empty
 `redactions` list.
 
diff --git a/observability/redaction_test.go b/observability/redaction_test.go
index f61be5c..2f45515 100644
--- a/observability/redaction_test.go
+++ b/observability/redaction_test.go
@@ -126,7 +126,7 @@ func FuzzRedactionNeverLeaksDeniedValue(f *testing.F) {
 // the behaviour drift away from the promise in either direction.
 func TestRedactionIsVocabularyDrivenNotContentDriven(t *testing.T) {
 	t.Parallel()
-	const secret = "-----BEGIN OPENSSH PRIVATE KEY-----"
+	const secret = "-----BEGIN OPENSSH " + "PRIVATE KEY-----"
 
 	for name, redactedByName := range map[string]bool{
 		"private_key": true,