Add runbook pack spec, validator, legacy launcher, and workplans RBT-WP-0002..0006

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: sonnet
Assistant-Process: 295952@bnt-lap001
Assistant-Session: e93f64ad-516c-46eb-9666-aad8d300c477

workplans/RBT-WP-0001-statehub-bootstrap.md

@@ -4,7 +4,7 @@ type: workplan
 title: "Bootstrap State Hub integration"
 domain: infotech
 repo: runbook-tutorials
-status: ready
+status: finished
 owner: codex
 topic_slug: stack
 created: "2026-09-29"
@@ -19,7 +19,7 @@ Runbook-tutorial engine and UI that guides operators through parameterized IT ad
 
 ```task
 id: RBT-WP-0001-T01
-status: todo
+status: done
 priority: high
 ```
 
@@ -30,7 +30,7 @@ Replace generated placeholders with repo-specific facts where needed.
 
 ```task
 id: RBT-WP-0001-T02
-status: todo
+status: done
 priority: high
 ```
 
@@ -42,7 +42,7 @@ changes confidently.
 
 ```task
 id: RBT-WP-0001-T03
-status: todo
+status: done
 priority: medium
 ```
 

workplans/RBT-WP-0002-runbook-pack-spec-and-validator.md

@@ -0,0 +1,74 @@
+---
+id: RBT-WP-0002
+type: workplan
+title: "Runbook pack specification and validator"
+domain: infotech
+repo: runbook-tutorials
+status: active
+flavor: implementation
+owner: claude
+topic_slug: stack
+created: "2026-09-29"
+updated: "2026-09-29"
+---
+
+## Goal
+
+Define what a runbook pack is, so packs can live in the repos that own them and
+the engine can load, validate and present them. The pack spec is the contract
+between this repo and every pack owner.
+
+## Publish the pack specification
+
+```task
+id: RBT-WP-0002-T01
+status: done
+priority: high
+```
+
+`docs/pack-spec.md` v0.1: manifest fields, parameters (never secret), steps with
+mandatory verification, rollback for state-changing steps, exercise status per the
+attended-procedure standard, and the legacy-command engine.
+
+## Encode the specification as a JSON Schema
+
+```task
+id: RBT-WP-0002-T02
+status: done
+priority: high
+```
+
+`schema/runbook-pack.schema.json` with conditional requirements per engine.
+
+## Implement discovery, validation and rendering
+
+```task
+id: RBT-WP-0002-T03
+status: done
+priority: high
+```
+
+`rtut/pack.py` and the CLI (`python -m rtut list|validate|show|render`), with
+semantic checks the schema cannot express (placeholders, duplicates, rollback,
+secret markers, parameter defaults) and 16 tests. Parameter rendering rejects
+unsafe characters.
+
+## Review the specification with the operator and freeze v0.1
+
+```task
+id: RBT-WP-0002-T04
+status: todo
+priority: high
+```
+
+Walk through the spec with Bernd against the real NetKingdom packs and the
+legacy console. Open questions: step branching and conditional steps; whether
+`verify` may run a command automatically; how packs declare dependencies on
+other packs; signed packs. Record decisions and freeze `runbook-pack/v0.1`, or
+raise v0.2 with a migration note.
+
+## Acceptance Criteria
+
+- Every pack in this repo and in `net-kingdom` validates.
+- Invalid packs fail with a clear error; tests cover each rule.
+- The spec names how the pre-existing console stays working.

workplans/RBT-WP-0003-engine-core-run-state-and-evidence.md

@@ -0,0 +1,74 @@
+---
+id: RBT-WP-0003
+type: workplan
+title: "Engine core: run state and evidence"
+domain: infotech
+repo: runbook-tutorials
+status: ready
+flavor: implementation
+owner: claude
+topic_slug: stack
+created: "2026-09-29"
+updated: "2026-09-29"
+depends_on: [RBT-WP-0002]
+---
+
+## Goal
+
+Give the engine memory: a run of a pack keeps non-secret parameter values,
+per-step state and evidence, and is the only thing allowed to change a pack's
+exercise status.
+
+## Design the run record
+
+```task
+id: RBT-WP-0003-T01
+status: todo
+priority: high
+```
+
+Specify `runbook-run/v0.1`: pack id and revision, operator label, parameter
+values, per-step state (`todo|running|done|failed|skipped`), timestamps,
+evidence facts, verification results. Non-secret only, with the same secret-marker
+rejection as packs. Stored under `.local/runbook-runs/` in the repo being operated.
+
+## Implement the run store and step state machine
+
+```task
+id: RBT-WP-0003-T02
+status: todo
+priority: high
+```
+
+Create, resume and list runs. Enforce order, block a step until the previous
+one verified, record failures without losing state. Tests for restart and
+resume.
+
+## Implement verification
+
+```task
+id: RBT-WP-0003-T03
+status: todo
+priority: medium
+```
+
+`manual`, `exit-0` and `output-contains` checks. Commands are shown to the
+operator; the engine runs a verify command only when the operator confirms
+it, with a timeout and captured output size only (no output stored).
+
+## Exercise-status writer
+
+```task
+id: RBT-WP-0003-T04
+status: todo
+priority: medium
+```
+
+When every step of a run has verified, offer to write
+`exercise_status: exercised <date> by <operator>` into `pack.yaml` via a
+reviewable diff. Never edit automatically.
+
+## Acceptance Criteria
+
+- A run survives restart and records outcomes without secrets.
+- A pack becomes `exercised` only through a completed, verified run.

workplans/RBT-WP-0004-local-runbook-ui.md

@@ -0,0 +1,72 @@
+---
+id: RBT-WP-0004
+type: workplan
+title: "Local runbook UI"
+domain: infotech
+repo: runbook-tutorials
+status: ready
+flavor: implementation
+owner: claude
+topic_slug: stack
+created: "2026-09-29"
+updated: "2026-09-29"
+depends_on: [RBT-WP-0003]
+---
+
+## Goal
+
+The interface that made the operator ask for this: a local web UI (and a
+terminal fallback) that shows where you are in a runbook, what to do next, and
+what you have proven.
+
+## Review the existing console's interaction model
+
+```task
+id: RBT-WP-0004-T01
+status: todo
+priority: high
+```
+
+Run `make security-bootstrap-ui` in `net-kingdom` with Bernd and record what to keep
+(state chips `nil/set/err/ok`, next safe action, copyable command blocks,
+approval phrase) and what to change. Output: a short UX note in `docs/`.
+
+## Build the step view
+
+```task
+id: RBT-WP-0004-T02
+status: todo
+priority: high
+```
+
+Parameter form, ordered steps with owner tags, rendered copyable commands,
+"done when" with confirm/verify, rollback shown beside each step, progress
+overview, resume after restart. Localhost only, no external calls, whynot-design
+posture, works without JavaScript frameworks.
+
+## Terminal mode
+
+```task
+id: RBT-WP-0004-T03
+status: todo
+priority: medium
+```
+
+`rtut run <pack>` walking the same run record in the terminal, for hosts
+without a browser.
+
+## Evidence view and export
+
+```task
+id: RBT-WP-0004-T04
+status: todo
+priority: medium
+```
+
+Show the run record, export it as non-secret JSON, and produce the exercise-status
+diff from RBT-WP-0003-T04.
+
+## Acceptance Criteria
+
+- Bernd can complete the SSH tutorial pack in the UI without pasting outputs to an agent.
+- The UI refuses to display or store anything matching the secret markers.

workplans/RBT-WP-0005-legacy-adapter-and-console-migration.md

@@ -0,0 +1,87 @@
+---
+id: RBT-WP-0005
+type: workplan
+title: "Legacy adapter and console migration"
+domain: infotech
+repo: runbook-tutorials
+status: active
+flavor: implementation
+owner: claude
+topic_slug: stack
+created: "2026-09-29"
+updated: "2026-09-29"
+depends_on: [RBT-WP-0002]
+---
+
+## Goal
+
+Carry the NetKingdom security bootstrap console into this ecosystem without
+breaking it: first as an unchanged legacy pack, then, only where worthwhile, by
+moving its generic parts into the engine.
+
+## Wrap the console as a legacy pack
+
+```task
+id: RBT-WP-0005-T01
+status: done
+priority: high
+```
+
+`net-kingdom/runbooks/security-bootstrap-console/pack.yaml`
+(`engine: legacy-command`) validates and lists it, with no change to
+`tools/security-bootstrap-console/`.
+
+## Implement launch and health for legacy packs
+
+```task
+id: RBT-WP-0005-T02
+status: done
+priority: high
+```
+
+`rtut launch <pack>` runs `legacy.command` from the owning repo root, waits for
+`legacy.url` to answer, and reports it. It stops the process it started. Test
+with a stub server.
+
+## Inventory the console
+
+```task
+id: RBT-WP-0005-T03
+status: todo
+priority: high
+```
+
+Classify the 5,300-line `security_bootstrap_console.py` into generic engine
+concerns (record and state model, gates, stage derivation, copyable blocks,
+approval phrase, localhost server) and NetKingdom-specific content (custody,
+OpenBao ceremony, KeyCape, privacyIDEA checks). Output: a migration map with
+the tests that pin current behaviour.
+
+## Extract the generic engine parts
+
+```task
+id: RBT-WP-0005-T04
+status: todo
+priority: medium
+```
+
+Move the generic parts into `rtut` behind the run record. The console in
+`net-kingdom` then imports them. Gate: the existing
+`tools/security-bootstrap-console/tests` pass unchanged before and after, and
+`make security-bootstrap-ui` behaves the same.
+
+## Decide the console's final form
+
+```task
+id: RBT-WP-0005-T05
+status: todo
+priority: low
+```
+
+With Bernd: keep the console as a permanent legacy pack, migrate its runbooks
+to native packs, or a mix. Record as a decision.
+
+## Acceptance Criteria
+
+- The console works unchanged throughout.
+- No secret handling is moved into the engine.

workplans/RBT-WP-0006-execution-mode-and-pack-index.md

@@ -0,0 +1,42 @@
+---
+id: RBT-WP-0006
+type: workplan
+title: "Execution mode and multi-repo pack index"
+domain: infotech
+repo: runbook-tutorials
+status: backlog
+flavor: implementation
+owner: claude
+topic_slug: stack
+created: "2026-09-29"
+updated: "2026-09-29"
+depends_on: [RBT-WP-0004]
+---
+
+## Goal
+
+Later capabilities, deliberately not started: opt-in execution of steps, and
+discovery of packs across the estate.
+
+## Opt-in, audited step execution
+
+```task
+id: RBT-WP-0006-T01
+status: wait
+priority: low
+```
+
+Per-step `execute: true` allowed only for `read-only` steps first, with an
+explicit operator confirmation, timeouts, and an audit record. Needs a
+decision on which identity runs the command.
+
+## Cross-repo pack index
+
+```task
+id: RBT-WP-0006-T02
+status: wait
+priority: low
+```
+
+`rtut list --estate` scans registered repos for `runbooks/*/pack.yaml` and publishes
+a capability entry in the registry. Needs a decision on scan scope.