runbook-tutorials/SCOPE.md

# SCOPE

## One-liner

The runbook-tutorial engine and local UI: it loads *runbook packs* and guides an
operator through parameterized administration procedures with visible state,
gates, verification, rollback and non-secret evidence.

## Core Idea

The engine is generic; the runbooks are not. A pack is a directory
`runbooks/<pack>/` in the repository that owns the procedure, described by a
manifest that follows the pack specification in `docs/pack-spec.md`. This repo
publishes the specification, the loader and validator, the UI, and a legacy
adapter that keeps pre-existing guided consoles (first: the NetKingdom security
bootstrap console) working unchanged.

## In Scope

- Runbook pack specification, JSON Schema, and versioning rules
- Attribute sets, projects and project templates, and runs of whole projects
- Pack discovery, loading, validation and conformance tests
- The local UI and CLI that present a pack and record progress
- Evidence records (non-secret), run outcomes and scores, and maturity derived from run history
- The legacy adapter for existing consoles
- Example and conformance packs

## Out of Scope

- Operational runbook content for other systems: it lives in the owning repo's `runbooks/`
- Storing, collecting or transmitting secrets
- Executing steps against infrastructure by default (guide first; execution is opt-in per step and audited)
- Task tracking (State Hub and workplans)
- Provider or tenant policy decisions

## Current State

- **Engine and UI: working.** Pack specifications v0.1 and v0.2 with validators; runs with verification, evidence, captures, overrides,
  waivers and deviations; manual and auto-confirm modes; locked and sealed closed runs with exportable, verifiable records; scores and
  durations; maturity derived from run history; attribute sets, projects, project templates and whole-project runs; a local web UI with a
  guided flow, a data view and an overview; CLI (`rtut`), packaging and tests.
- **Not built, by decision:** executing a step's command (auto-pilot, opt-in and audited), a cross-repository pack index, a runbook-aware
  feedback assistant, dependencies between runbooks, and a terminal walk-through. They are in `workplans/RBT-WP-0006`.
- **The NetKingdom security bootstrap console** stays a permanent legacy pack, launched unchanged. `docs/console-mapping.md` records why
  (seven gaps that a v0.3 would close first).
- **Real content** lives in the owning repositories: `net-kingdom/runbooks/` has three v0.2 packs awaiting their first attended run.

## Getting Oriented

- Direction: `INTENT.md`
- Documents: `docs/README.md`
- Pack specification: `docs/pack-spec-v0.2.md` (current) and `docs/pack-spec.md` (v0.1)
- Work state: `.custodian-brief.md` and `workplans/`