apiVersion: ops.aiwg.io/v1
kind: OpsCapability
metadata:
  name: bt6-release-validation-flow
  labels:
    category: release-management
    scope: cross-repository
  annotations:
    blast-radius: "read-only validation unless release publication is separately authorized"
spec:
  description: Run exhaustive repository-defined validation against an exact existing tag before release artifacts are promoted.
  version: "0.2.0"
  inputs:
    - name: tag
      type: string
      required: true
      description: Existing tag to resolve and validate at an exact commit.
  outputs:
    - name: resolved_context
      type: object
      description: Canonical repository, CI remote, profile, tag, and exact commit.
    - name: verification
      type: list
      description: Full-suite, documentation, integrity, risk, packaging, and platform results.
    - name: decision
      type: string
      description: pass, fail, or hold.
  target_requirements:
    os: [linux, macos]
    capabilities: [git]
  agent: bt6-release-integrator
  idempotent: true
  steps:
    - name: resolve-tag
      description: Resolve repository authority and bind the requested tag to an exact commit.
    - name: isolate-checkout
      description: Prepare an isolated checkout without overwriting unrelated local work.
    - name: run-full-suite
      description: Run every profile full command for the exact tagged commit.
    - name: run-release-checks
      description: Run applicable documentation, research-integrity, risk-surface, packaging, artifact, and platform checks.
    - name: reconcile-ci
      description: Compare results with CI evidence for the same tag and commit.
    - name: decide
      description: Pass only complete green validation; fail or hold blocks artifact promotion.
  verification:
    command: "git rev-parse --verify refs/tags/<tag>^{commit} >/dev/null"
    expect: "tag resolves and report binds all evidence to that exact commit"
