Extend profiles to groups and resources with explicit applicability and attribute validation

[arvindh123]

Problem

Atom profiles currently provide versioned attribute schemas for entities. The profile registry already supports object_kind values including entity, group, and resource, but groups and resources do not expose equivalent profile attachment and attribute validation through their current creation/update APIs.

Extend profiles so an application can declare what kind of object a profile applies to, attach a profile/version to that object, and have Atom reject attributes that do not satisfy its JSON Schema.

Example use case

Parallax could model an organization as an Atom tenant, a workspace as a top-level object group, a cluster as a child object group, and predictions/plans as resources. Profiles would define the attributes of each application concept:

Profile	Applies to	Example attributes
Workspace	Object group	region, environment
Cluster	Object group	provider, kubernetes_version
Prediction	Resource kind parallax_prediction	cluster_id, status
Plan	Resource kind parallax_plan	prediction_id, actions

Existing entity profiles must continue to work. Principal groups should also be eligible for group profiles, with explicit applicability to the selected group type.

Requested behavior

• Make profile applicability explicit in the API and UI: entity, group, or resource, plus the applicable entity/resource kind or group type. Reuse the existing object_kind/kind registry where possible; document group-kind semantics without conflating application profile names such as Workspace with Atom's object/principal group types.
• Support multiple profiles for the same compatible kind/type, for example Workspace and Cluster profiles for object groups.
• Add profile and profile-version references to groups and resources, their persistence models, and supported public APIs. Validate object type/kind and tenant compatibility when attaching or changing a profile.
• Validate attributes against the selected profile version on creation, attribute updates, and profile changes. Required fields, types, enum/range constraints, and additional-property rules must follow the supplied JSON Schema.
• Define version selection and lifecycle consistently with entity profiles. Existing objects should remain pinned to their selected version; publishing a new version must not silently reinterpret existing data.
• Cover all supported write paths, including bootstrap and any object-coordination API that is available when this is implemented, so alternate writes cannot bypass validation.
• Add compatible profile selection and schema-driven attribute forms for groups/resources in the UI.
• Keep profiles optional for existing objects and preserve existing authorization, group hierarchy, and resource-kind semantics. Profiles describe data; selecting a profile must not grant permissions.

Acceptance criteria

• A group/resource with a compatible profile and valid attributes can be created, retrieved, and updated with its profile/version references intact.
• Invalid attributes or incompatible profile assignments are rejected without partial writes; concurrent profile/attribute updates cannot evade validation.
• Object and principal group applicability is enforced, and resource/entity kind compatibility is enforced.
• Existing entity-profile behavior and unprofiled group/resource behavior remain compatible.
• Migration, API/schema documentation, UI behavior, and integration tests cover create/update, profile switching, version/lifecycle rules, and tenant boundaries.

Scope boundary

JSON Schema validation does not establish database relationships: validating cluster_id as a UUID does not prove that a cluster exists or enforce deletion/cardinality rules. General relationship constraints and transaction API expansion are separate concerns.

Current implementation pointers

• migrations/001_initial.sql: profiles, profile_versions, groups, and resources.
• src/identity/repo.rs: entity profile resolution and attribute validation.
• src/graphql/profiles.rs, src/graphql/groups.rs, src/graphql/resources.rs.
• apidocs/graphql-schema.graphql and docs/content/docs/user-guide/profiles.mdx.