fix(items): adopt spec #79 — tag the platform defaults, and give the install form a vocabulary

items/label-studio/components/label-studio.yaml

@@ -1,7 +1,7 @@
 specVersion: v1
 kind: COMPONENT
 metadata:
-  version: 2
+  version: 3
 spec:
   workload:
     kind: SERVICE
@@ -45,6 +45,7 @@ spec:
         suppliedBy: USER
         ui:
           label: Admin email
+          order: 1
         target:
           envVarKey: LABEL_STUDIO_USERNAME
         description: Email address for the bootstrap admin account
@@ -56,6 +57,7 @@ spec:
         suppliedBy: USER
         ui:
           label: Admin password
+          order: 2
         target:
           envVarKey: LABEL_STUDIO_PASSWORD
         generator:
@@ -85,13 +87,19 @@ spec:
       publicUrl:
         schema:
           type: STRING
+          format: ENDPOINT_URL
         isRequired: false
         suppliedBy: USER
         ui:
           label: Public URL
+          order: 4
+          prominence: SECONDARY
+          examples:
+            - https://label-studio.example.com
         target:
           envVarKey: LABEL_STUDIO_HOST
         platformDefault:
+          type: SELF_ADDRESS
           source: PUBLIC_URL
         description: >-
           Public base URL Label Studio builds absolute links from. Leave blank
@@ -115,16 +123,28 @@ spec:
       # Django — only entries containing '*' reach the subdomain-matching path
       # — and would make every other tenant's deployment on the shared edge a
       # trusted CSRF origin for this one.
+      # No `format` here, deliberately: the value is a comma-separated list, and
+      # every member of the format vocabulary names a convention the whole
+      # scalar follows. A two-origin list is not a URL, and component 6.4 binds
+      # a client's rendering -- one told this was a single URL could normalise
+      # or trim it and corrupt the list. The shape lives in ui.examples instead,
+      # where the no-trailing-slash rule above becomes machine-readable.
       csrfTrustedOrigins:
         schema:
           type: STRING
         isRequired: false
         suppliedBy: USER
         ui:
           label: Trusted origins
+          order: 5
+          prominence: SECONDARY
+          examples:
+            - https://label-studio.example.com
+            - https://label-studio.example.com,https://alt.example.com
         target:
           envVarKey: LABEL_STUDIO_CSRF_TRUSTED_ORIGINS
         platformDefault:
+          type: SELF_ADDRESS
           source: PUBLIC_URL
         description: >-
           Comma-separated origins Django accepts form POSTs from. Must match the
@@ -149,6 +169,7 @@ spec:
         suppliedBy: USER
         ui:
           label: Secret key
+          order: 3
         target:
           envVarKey: SECRET_KEY
         generator:

items/mlflow/components/mlflow.yaml

@@ -1,7 +1,7 @@
 specVersion: v1
 kind: COMPONENT
 metadata:
-  version: 1
+  version: 2
 spec:
   workload:
     kind: SERVICE
@@ -62,11 +62,16 @@ spec:
       backendStoreUri:
         schema:
           type: STRING
+          format: CONNECTION_STRING
           default: sqlite:////mlflow/mlflow.db
         isRequired: true
         suppliedBy: USER
         ui:
           label: Backend store URI
+          order: 1
+          examples:
+            - sqlite:////mlflow/mlflow.db
+            - postgresql://mlflow:password@postgres.internal:5432/mlflow
         target:
           envVarKey: MLFLOW_BACKEND_STORE_URI
         description: SQLAlchemy URI for the tracking metadata store. Default uses
@@ -79,6 +84,10 @@ spec:
         suppliedBy: USER
         ui:
           label: Artifact storage destination
+          order: 2
+          examples:
+            - s3://my-bucket/mlflow
+            - gs://my-bucket/mlflow
         # MLFLOW_ARTIFACTS_DESTINATION (not MLFLOW_DEFAULT_ARTIFACT_ROOT): the
         # server proxies artifact reads/writes to this destination, so remote
         # clients never interpret the path against their own filesystem

items/n8n/components/n8n.yaml

@@ -1,7 +1,7 @@
 specVersion: v1
 kind: COMPONENT
 metadata:
-  version: 1
+  version: 2
 spec:
   workload:
     kind: SERVICE
@@ -53,27 +53,39 @@ spec:
       n8nHost:
         schema:
           type: STRING
+          format: HOSTNAME
         isRequired: false
         suppliedBy: USER
         ui:
           label: Public hostname
+          order: 2
+          prominence: SECONDARY
+          examples:
+            - n8n.example.com
         target:
           envVarKey: N8N_HOST
         platformDefault:
+          type: SELF_ADDRESS
           source: PUBLIC_HOSTNAME
         description: >-
           Public hostname n8n uses for webhook URLs. Leave blank to use this
           deployment's own generated hostname; override only for a custom domain.
       webhookUrl:
         schema:
           type: STRING
+          format: ENDPOINT_URL
         isRequired: false
         suppliedBy: USER
         ui:
           label: Webhook base URL
+          order: 3
+          prominence: SECONDARY
+          examples:
+            - https://n8n.example.com
         target:
           envVarKey: WEBHOOK_URL
         platformDefault:
+          type: SELF_ADDRESS
           source: PUBLIC_URL
         description: >-
           Full public base URL n8n registers webhooks under. Without it n8n
@@ -83,13 +95,19 @@ spec:
       editorBaseUrl:
         schema:
           type: STRING
+          format: ENDPOINT_URL
         isRequired: false
         suppliedBy: USER
         ui:
           label: Editor base URL
+          order: 4
+          prominence: SECONDARY
+          examples:
+            - https://n8n.example.com
         target:
           envVarKey: N8N_EDITOR_BASE_URL
         platformDefault:
+          type: SELF_ADDRESS
           source: PUBLIC_URL
         description: >-
           Public URL of the n8n editor, used in emails and OAuth/SAML redirects.
@@ -98,11 +116,13 @@ spec:
       timezone:
         schema:
           type: STRING
+          format: TIMEZONE
           default: UTC
         isRequired: false
         suppliedBy: USER
         ui:
           label: Timezone
+          order: 1
         target:
           envVarKey: GENERIC_TIMEZONE
         description: IANA timezone for scheduled workflows

items/open-webui/components/open-webui.yaml

@@ -1,7 +1,7 @@
 specVersion: v1
 kind: COMPONENT
 metadata:
-  version: 2
+  version: 3
 spec:
   workload:
     kind: SERVICE
@@ -45,21 +45,31 @@ spec:
         suppliedBy: USER
         ui:
           label: Enable Ollama API
+          order: 1
         target:
           envVarKey: ENABLE_OLLAMA_API
         description: >-
           Enable the Ollama backend integration. Off by default because no Ollama
           ships with this deployment; turn on only when an Ollama endpoint is
           reachable (and set the base URL), otherwise the UI logs pointless
           connection errors (docs.openwebui.com env-configuration).
+      # PRIMARY, not SECONDARY, and it belongs directly under the switch above.
+      # The six platform-default inputs elsewhere in the corpus are advanced
+      # because the platform has already computed the right value; this one's
+      # default is knowingly wrong for this deployment, and a field whose default
+      # cannot work must not sit behind a disclosure.
       ollamaBaseUrl:
         schema:
           type: STRING
+          format: ENDPOINT_URL
           default: http://ollama:11434
         isRequired: false
         suppliedBy: USER
         ui:
           label: Ollama base URL
+          order: 2
+          examples:
+            - https://ollama.example.com
         target:
           envVarKey: OLLAMA_BASE_URL
         description: >-
@@ -75,6 +85,7 @@ spec:
         suppliedBy: USER
         ui:
           label: WebUI secret key
+          order: 3
         target:
           envVarKey: WEBUI_SECRET_KEY
         generator:

items/openclaw/components/openclaw.yaml

@@ -1,7 +1,7 @@
 specVersion: v1
 kind: COMPONENT
 metadata:
-  version: 1
+  version: 2
 spec:
   workload:
     kind: SERVICE
@@ -150,6 +150,7 @@ spec:
         suppliedBy: USER
         ui:
           label: Gateway token
+          order: 1
         target:
           envVarKey: OPENCLAW_GATEWAY_TOKEN
         generator:
@@ -160,13 +161,19 @@ spec:
       publicOrigin:
         schema:
           type: STRING
+          format: ENDPOINT_URL
         isRequired: false
         suppliedBy: USER
         ui:
           label: Public origin
+          order: 3
+          prominence: SECONDARY
+          examples:
+            - https://openclaw.example.com
         target:
           envVarKey: OPENCLAW_PUBLIC_ORIGIN
         platformDefault:
+          type: SELF_ADDRESS
           source: PUBLIC_URL
         description: >-
           Public https origin of this deployment's Control UI, written into
@@ -176,11 +183,13 @@ spec:
       timezone:
         schema:
           type: STRING
+          format: TIMEZONE
           default: UTC
         isRequired: false
         suppliedBy: USER
         ui:
           label: Timezone
+          order: 2
         # The container consumes the standard TZ variable (upstream compose maps
         # its host-side OPENCLAW_TZ input onto TZ; OPENCLAW_TZ itself is not read
         # by the gateway runtime).

items/postgres/blueprint.yaml

@@ -2,7 +2,7 @@ specVersion: v1
 kind: BLUEPRINT
 metadata:
   slug: postgres
-  version: 1
+  version: 2
 spec:
   components:
     db:

items/postgres/components/postgres.yaml

@@ -1,7 +1,7 @@
 specVersion: v1
 kind: COMPONENT
 metadata:
-  version: 1
+  version: 2
 spec:
   workload:
     kind: SERVICE
@@ -32,8 +32,19 @@ spec:
         suppliedBy: USER
         ui:
           label: Database password
+          order: 1
         target:
           envVarKey: POSTGRES_PASSWORD
+        # ALPHANUMERIC rather than HEX so the value survives being pasted into a
+        # postgresql:// URL without percent-encoding. 32 bytes matches the other
+        # machine credentials in the corpus; the 24-byte tier is for passwords a
+        # person reads and types.
+        generator:
+          byteLength: 32
+          encoding: ALPHANUMERIC
+        description: >-
+          Auto-generated password for the database superuser; copy it from the
+          deployment's Configuration tab.
       postgresUser:
         schema:
           type: STRING
@@ -42,6 +53,7 @@ spec:
         suppliedBy: USER
         ui:
           label: Database user
+          order: 2
         target:
           envVarKey: POSTGRES_USER
       postgresDb:
@@ -52,6 +64,7 @@ spec:
         suppliedBy: USER
         ui:
           label: Database name
+          order: 3
         target:
           envVarKey: POSTGRES_DB
     outputs:

items/postgres/listing.yaml

@@ -2,7 +2,7 @@ specVersion: v1
 kind: LISTING
 metadata:
   slug: postgres
-  version: 1
+  version: 2
 spec:
   listingKind: COMPONENT
   displayName: PostgreSQL
@@ -25,9 +25,10 @@ spec:
     ## Defaults
     Single-container deployment of `postgres:17.10-alpine` listening on
     the standard port 5432 as a private TCP endpoint — reachable by your
-    other workloads, not exposed to the public internet. You supply the
-    database password at deploy; the user defaults to `postgres` and the
-    database name to `app`. A 10 GiB persistent volume mounted at
+    other workloads, not exposed to the public internet. The database
+    password is auto-generated at deploy — copy it from the deployment's
+    Configuration tab; the user defaults to `postgres` and the database
+    name to `app`. A 10 GiB persistent volume mounted at
     `/var/lib/postgresql/data` keeps the data directory across restarts.
   category: INFRASTRUCTURE
   lifecycleStage: STABLE