feat(mcp): add governed cross-product control plane

apps/api/src/models/mcp_control_plane.py

@@ -0,0 +1,67 @@
+"""Response contracts for the cross-product MCP control plane."""
+
+from __future__ import annotations
+
+from typing import Any
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+class McpCapabilityReadback(BaseModel):
+    """One governed internal capability or external discovery candidate."""
+
+    model_config = ConfigDict(extra="allow")
+
+    capability_id: str
+    title: str
+    source_type: str
+    catalog_source: str
+    catalog_url: str | None = None
+    decision: str
+    risk_tier: str
+    scope: str
+    data_boundary: str
+    deployment_allowed: bool
+    version_state: str
+    digest_state: str
+    sbom_state: str
+    signature_state: str
+    rag_policy: str
+    blockers: list[str] = Field(default_factory=list)
+    evidence_refs: list[str] = Field(default_factory=list)
+
+
+class McpProductReadback(BaseModel):
+    """One product joined with Gitea truth and MCP desired/observed state."""
+
+    model_config = ConfigDict(extra="allow")
+
+    product_id: str
+    canonical_repo: str
+    source_control_status: str
+    inventory_state: str
+    existing_capability_ids: list[str]
+    recommended_capability_ids: list[str]
+    rejected_capability_ids: list[str]
+    blockers: list[str]
+
+
+class McpControlPlaneOverview(BaseModel):
+    """Redacted read-only cockpit payload."""
+
+    schema_version: str
+    generated_at: str
+    status: str
+    summary: dict[str, Any]
+    architecture: dict[str, Any]
+    security_policy: dict[str, Any]
+    supply_chain_policy: dict[str, Any]
+    version_lifecycle: dict[str, Any]
+    runtime: dict[str, Any]
+    catalog_sources: list[dict[str, Any]]
+    capabilities: list[McpCapabilityReadback]
+    products: list[McpProductReadback]
+    active_blockers: list[str]
+    next_actions: list[str]
+    operation_boundaries: dict[str, bool]
+    source_refs: dict[str, str]