Split capability navigation domains; canon 0.2.1 (OQ-2 resolved)

Security & Governance splits into `security` (secrets, keys, policy,
vulnerability) and `governance` (evidence, lifecycle). Every capability id
is unchanged — domains are navigation_only, so this is a table-of-contents
change, not a concept change.

- capabilities.yaml: 41 capabilities across 9 domains
- ITC-CAP §8 catalog table and promotion gate updated
- OQ-2 closed; decision record added to ASSIMILATION.md
- canon 0.2.0 -> 0.2.1 (patch) + CHANGELOG entry
- ITC-WP-0014 T01 done, workplan active

make validate: ok. make test: 22 passed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -15,6 +15,39 @@ semantics.
 
 ---
 
+## 0.2.1 — 2026-08-15
+
+### Changed — Capability navigation domains split (OQ-2 resolved)
+
+**Change.** The `security` navigation domain ("Security & Governance") is split
+into `security` (`security.secrets`, `security.keys`, `security.policy`,
+`security.vulnerability`) and `governance` (`governance.evidence`,
+`governance.lifecycle`). The baseline is now **41 capabilities across 9
+navigation domains**.
+
+**Rationale.** Four capabilities in the domain used the `security.` prefix while
+two used `governance.`. Capability ids are durable interfaces (CAP-R5), so the
+mismatch could not be corrected later without migration semantics, and it blocked
+promotion of ITC-CAP beyond `proposed`. Navigation domains are declared
+`navigation_only: true` and carry no semantics, so splitting one is a
+table-of-contents change.
+
+**Options rejected.** Keeping the mismatch (leaves a defect in the model's primary
+index); renumbering `governance.*` to `security.*` (breaks two durable interfaces
+for a cosmetic gain, requiring a major version).
+
+**Breaking:** no. **No capability id, anchor, profile, quality dimension, evidence
+hook, or relationship changed.** Artifact count, schemas, and consumers are
+unaffected.
+
+**Records.** Decision record in
+`infospace/assimilation/it-capability-canon/ASSIMILATION.md`; OQ-2 closed in
+`open-questions.md`; `ITC-WP-0014` T01 done.
+
+**Validation.** `make validate` 0 errors / 0 warnings; `make test` 22 passed.
+
+---
+
 ## 0.2.0 — 2026-08-14
 
 ### Added — InfoTechCanon Capability Model (`ITC-CAP`)

canon.yaml

@@ -1,7 +1,7 @@
 repository: info-tech-canon
 title: InfoTechCanon
 status: service-baseline
-version: 0.2.0
+version: 0.2.1
 description: >
   An evolving, markdown-first canon for building interoperable, adaptable,
   and extensible information-processing systems.
@@ -170,4 +170,4 @@ next_actions:
   - implement ITC-WP-0003 validation and generated views
   - implement ITC-WP-0004 small-saas profile proof
   - explore ITC-WP-0006 PURPOSES model extension
-  - resolve ITC-WP-0014 T01 capability identifier prefix (blocks ITC-CAP promotion)
+  - publish ITC-WP-0014 T02 capability.schema.yaml (next ITC-CAP promotion gate)

infospace/assimilation/it-capability-canon/ASSIMILATION.md

@@ -136,3 +136,45 @@ requirement set with evidence.
 
 **Supersession.** None. A later ITCC revision arrives as a new intake with a new
 `source_version`, never as an edit to this frozen snapshot.
+
+---
+
+## Decision Record — OQ-2, capability identifier prefix
+
+**Date:** 2026-08-15 · **Canon version:** 0.2.1
+
+**Context.** Four capabilities in navigation domain `security` used the
+`security.` prefix while two used `governance.` (`governance.evidence`,
+`governance.lifecycle`). Capability ids are durable interfaces (CAP-R5), so the
+inconsistency could not simply be corrected later without migration semantics.
+This blocked promotion beyond `proposed`.
+
+**Decision.** Split the "Security & Governance" navigation domain into two
+domains, `security` (4 capabilities) and `governance` (2). Every capability id is
+unchanged; each now sits in the domain its prefix names. The baseline becomes 41
+capabilities across 9 navigation domains.
+
+**Options considered.**
+
+1. *Keep as-is.* Rejected: leaves a visible defect in the primary index of a model
+   whose whole value is stable, legible identifiers.
+2. *Renumber `governance.*` to `security.*`.* Rejected: breaks two durable
+   interfaces to fix a cosmetic issue, and would require a canon major version
+   with migration semantics.
+3. *Split the navigation domain.* Chosen.
+
+**Rationale.** Domains are declared `navigation_only: true` and carry no
+semantics (§4.2, Core §6.4 *Network Before Tree*), so splitting one costs nothing
+structurally. It is the only option that removes the inconsistency without
+touching an id.
+
+**Consequences.**
+
+- Canon `0.2.1` (patch: no concept added, removed, renamed, or reassigned).
+- `security.policy` and `governance.evidence` now appear in different sections of
+  the catalog index despite being frequently co-used — an accepted navigation
+  cost, and the reason option 1 was defensible.
+- OQ-2 no longer blocks promotion; `ITC-WP-0014` T01 is complete.
+
+**Review trigger.** If a third capability group emerges that spans both domains,
+revisit whether navigation domains should be replaced by tags.

infospace/assimilation/it-capability-canon/open-questions.md

@@ -6,19 +6,17 @@ Resolved for now as a **model** (broad domain structure). If capability contract
 later grow enforcement rules and conformance levels for consumers, part of it may
 split into a standard. **Review trigger:** first consumer conformance request.
 
-## OQ-2 — The `governance.*` prefix inside the Security & Governance domain
+## OQ-2 — The `governance.*` prefix inside the Security & Governance domain — **RESOLVED 2026-08-15 (canon 0.2.1)**
 
-Six capabilities sit in navigation domain `security` but two use a `governance.`
+Six capabilities sat in navigation domain `security` but two used a `governance.`
 ID prefix (`governance.evidence`, `governance.lifecycle`). Options:
 
 1. keep as-is — IDs are durable interfaces and already drafted;
 2. renumber to `security.*` — consistent prefixes, but breaks IDs;
 3. split the navigation domain into `security` and `governance`.
 
-Capability IDs are durable interfaces, so this must be settled **before**
+**Decision: option 3.** See the OQ-2 decision record in
-promotion beyond `proposed`. Preference: option 3 — it preserves every ID and
+[`ASSIMILATION.md`](ASSIMILATION.md). No longer blocks promotion.
-removes the inconsistency. **Owner:** canon owner. **Blocks:** promotion to
-`draft`/`release-candidate`.
 
 ## OQ-3 — Should the intended/declared/applied/observed/assessed state qualifier be canon-wide?
 

infospace/models/capability/InfoTechCanonCapabilityModel.md

@@ -345,7 +345,7 @@ ConsumerPurpose --requires--> Capability <--provides-- Service
 
 # 8. Catalog
 
-The baseline is **41 capabilities across 8 navigation domains**, held in
+The baseline is **41 capabilities across 9 navigation domains**, held in
 `models/capability/capabilities.yaml`.
 
 | Domain | Count | Capability ids |
@@ -355,7 +355,8 @@ The baseline is **41 capabilities across 8 navigation domains**, held in
 | Integration & Communication | 5 | `integration.api`, `integration.messaging`, `integration.exchange`, `integration.notification`, `integration.traffic` |
 | Runtime & Automation | 5 | `runtime.execution`, `runtime.configuration`, `runtime.scheduling`, `runtime.workflow`, `runtime.deployment` |
 | Operations & Assurance | 5 | `operations.observability`, `operations.alerting`, `operations.audit`, `operations.recovery`, `operations.continuity` |
-| Security & Governance | 6 | `security.secrets`, `security.keys`, `security.policy`, `security.vulnerability`, `governance.evidence`, `governance.lifecycle` |
+| Security | 4 | `security.secrets`, `security.keys`, `security.policy`, `security.vulnerability` |
+| Governance | 2 | `governance.evidence`, `governance.lifecycle` |
 | Commerce | 4 | `commerce.metering`, `commerce.billing`, `commerce.payment`, `commerce.entitlement` |
 | Intelligence | 5 | `intelligence.generation`, `intelligence.extraction`, `intelligence.embedding`, `intelligence.retrieval`, `intelligence.reasoning` |
 
@@ -386,9 +387,9 @@ model. This is accepted at `proposed` status and tracked as OQ-5.
 
 This model enters the canon at status `proposed`. Promotion requires:
 
-1. resolution of assimilation open question **OQ-2** (the `governance.*` id prefix
+1. ~~resolution of assimilation open question **OQ-2**~~ — **resolved in canon
-   inside the Security & Governance domain) — blocking, because ids are durable
+   0.2.1**: the Security & Governance navigation domain was split into `security`
-   interfaces;
+   and `governance`, aligning every id with its domain and changing no id;
 2. publication of `capability.schema.yaml` validating contracts;
 3. at least one canon Profile expressing a real capability requirement set with
    evidence;

infospace/models/capability/capabilities.yaml

@@ -14,7 +14,7 @@ canon:
   artifact_id: model/capability
   version: 0.1.0
   status: proposed
-  canon_version: 0.2.0
+  canon_version: 0.2.1
   purpose: Canonical, implementation-independent catalog of the abilities an information system may require
     or provide.
   normative_document: models/capability/InfoTechCanonCapabilityModel.md
@@ -665,7 +665,7 @@ domains:
     - availability_metrics
     typical_resource_classes: *id005
 - id: security
-  name: Security & Governance
+  name: Security
   navigation_only: true
   capabilities:
   - id: security.secrets
@@ -750,6 +750,10 @@ domains:
     - scan_results
     - remediation_records
     typical_resource_classes: *id006
+- id: governance
+  name: Governance
+  navigation_only: true
+  capabilities:
   - id: governance.evidence
     name: Compliance Evidence
     purpose: Produce and maintain evidence supporting governance, assurance, certification, or compliance

workplans/ITC-WP-0014-capability-model-consolidation.md

@@ -5,10 +5,10 @@ title: "Capability Model consolidation (post-ITCC assimilation)"
 domain: infotech
 topic_slug: canon
 repo: info-tech-canon
-status: proposed
+status: active
 priority: medium
 created: "2026-08-14"
-updated: "2026-08-14"
+updated: "2026-08-15"
 depends_on_workplans:
   - ITC-WP-0003
   - ITC-WP-0006
@@ -41,7 +41,7 @@ question that is blocking because capability ids are durable interfaces.
 
 ```task
 id: ITC-WP-0014-T01
-status: todo
+status: done
 priority: high
 state_hub_task_id: "4074193b-04dc-4168-b7af-f42e94417321"
 ```
@@ -50,6 +50,10 @@ Decide between keeping the ids, renumbering to `security.*`, or splitting the
 navigation domain into `security` and `governance` (preferred — preserves every
 id). Record as a DecisionRecord. **Blocks promotion beyond `proposed`.**
 
+**Done 2026-08-15 (canon 0.2.1):** navigation domain split into `security` (4)
+and `governance` (2); no capability id changed. Decision record in
+`assimilation/it-capability-canon/ASSIMILATION.md`; OQ-2 closed.
+
 ### T02 — Publish `capability.schema.yaml`
 
 ```task

workplans/index.yaml

@@ -195,7 +195,7 @@ workplans:
 
   - id: ITC-WP-0014
     title: Capability Model consolidation (post-ITCC assimilation)
-    status: proposed
+    status: active
     priority: medium
     path: workplans/ITC-WP-0014-capability-model-consolidation.md
     depends_on: