feat(platform): rehearse metadata provider identity

.github/workflows/ci.yml

@@ -19,6 +19,8 @@ on:
       - feat/ar1-metadata-fabric-ingestion-contract
       - feat/ar1-metadata-fabric-local-ingestion-replay
       - feat/ar1-metadata-fabric-binding-ledger
+      - feat/ar1-metadata-fabric-openlineage-delivery
+      - feat/ar1-metadata-fabric-provider-identity
 
 env:
   PYTHON_VERSION: "3.13"
@@ -128,6 +130,9 @@ jobs:
       - name: Validate metadata fabric OpenLineage delivery evidence
         run: python -m data_agent.metadata_fabric_lineage_delivery validate
 
+      - name: Validate metadata fabric provider identity evidence
+        run: python -m data_agent.metadata_fabric_provider_identity validate
+
       - name: Validate DolphinScheduler adapter boundary
         run: python -m data_agent.dolphinscheduler_adapter validate
 
@@ -183,6 +188,7 @@ jobs:
             data_agent/test_metadata_fabric_ingestion_replay.py \
             data_agent/test_metadata_fabric_binding_contract.py \
             data_agent/test_metadata_fabric_lineage_delivery.py \
+            data_agent/test_metadata_fabric_provider_identity.py \
             data_agent/test_metadata_fabric_otel_failure_rehearsal.py \
             data_agent/test_metadata_fabric_otel_metrics.py \
             data_agent/test_metadata_fabric_provider_metrics.py \

config/metadata-fabric-provider-identity.local.yaml

@@ -0,0 +1,59 @@
+schema: gda.metadata_fabric_provider_identity_profile.v1
+environment: local_docker_desktop
+
+cluster:
+  context: docker-desktop
+  namespace: gda-metadata-sandbox
+
+providers:
+  openmetadata:
+    version: 1.13.1
+    workload: deployment/openmetadata
+    service: openmetadata
+    service_port: 8585
+    service_account: openmetadata
+    auth_mode: local_basic_bootstrap_provisioner
+    bootstrap_username_env: GDA_OPENMETADATA_USERNAME
+    bootstrap_password_env: GDA_OPENMETADATA_PASSWORD
+  gravitino:
+    version: 1.3.0
+    workload: statefulset/metadata-gravitino
+    service: metadata-gravitino
+    service_port: 8090
+    authenticator: simple
+    access_control_enabled: false
+
+identity:
+  policy: GdaMetadataTableProjectionPolicy
+  role: GdaMetadataTableProjectionRole
+  user: gda-metadata-table-projection
+  email: gda-metadata-table-projection@open-metadata.org
+  bot: gda-metadata-table-projection-bot
+  mandatory_default_role: DefaultBotRole
+  jwt_expiry: OneHour
+  allowed_rule:
+    name: GdaMetadataTableCreate
+    effect: allow
+    operations: [Create]
+    resources: [table]
+
+probes:
+  allowed_table_create:
+    database_schema: gda_lakehouse.land_use.published
+    table: gda_provider_identity_probe
+  denied_policy_create:
+    collection: policies
+    operation: Create
+    name: GdaUnauthorizedPolicyProbe
+
+claims:
+  local_openmetadata_bounded_identity_verified: false
+  local_openmetadata_minimum_privilege_verified: false
+  local_openmetadata_jwt_rotation_verified: false
+  local_openmetadata_jwt_revocation_verified: false
+  provider_minimum_privilege_verified: false
+  protected_workload_identity_verified: false
+  oidc_verified: false
+  gravitino_authentication_verified: false
+  production_identity_verified: false
+  production_ready: false