Scaffold runbook-tutorials repo: intent, scope, agent rules, State Hub registration

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

SCOPE.md

@@ -0,0 +1,45 @@
+# SCOPE
+
+## One-liner
+
+The runbook-tutorial engine and local UI: it loads *runbook packs* and guides an
+operator through parameterized administration procedures with visible state,
+gates, verification, rollback and non-secret evidence.
+
+## Core Idea
+
+The engine is generic; the runbooks are not. A pack is a directory
+`runbooks/<pack>/` in the repository that owns the procedure, described by a
+manifest that follows the pack specification in `docs/pack-spec.md`. This repo
+publishes the specification, the loader and validator, the UI, and a legacy
+adapter that keeps pre-existing guided consoles (first: the NetKingdom security
+bootstrap console) working unchanged.
+
+## In Scope
+
+- Runbook pack specification, JSON Schema, and versioning rules
+- Pack discovery, loading, validation and conformance tests
+- The local UI and CLI that present a pack and record progress
+- Evidence records (non-secret) and exercise-status tracking
+- The legacy adapter for existing consoles
+- Example and conformance packs
+
+## Out of Scope
+
+- Operational runbook content for other systems: it lives in the owning repo's `runbooks/`
+- Storing, collecting or transmitting secrets
+- Executing steps against infrastructure by default (guide first; execution is opt-in per step and audited)
+- Task tracking (State Hub and workplans)
+- Provider or tenant policy decisions
+
+## Current State
+
+- Status: bootstrap. Specification and workplans are being written; extraction of the
+  console from `net-kingdom` (`tools/security-bootstrap-console/`) is planned in
+  `workplans/`.
+
+## Getting Oriented
+
+- Direction: `INTENT.md`
+- Pack specification: `docs/pack-spec.md`
+- Work state: `.custodian-brief.md` and `workplans/`