# SCOPE

## One-liner

The runbook-tutorial engine and local UI: it loads *runbook packs* and guides an
operator through parameterized administration procedures with visible state,
gates, verification, rollback and non-secret evidence.

## Core Idea

The engine is generic; the runbooks are not. A pack is a directory
`runbooks/<pack>/` in the repository that owns the procedure, described by a
manifest that follows the pack specification in `docs/pack-spec.md`. This repo
publishes the specification, the loader and validator, the UI, and a legacy
adapter that keeps pre-existing guided consoles (first: the NetKingdom security
bootstrap console) working unchanged.

## In Scope

- Runbook pack specification, JSON Schema, and versioning rules
- Pack discovery, loading, validation and conformance tests
- The local UI and CLI that present a pack and record progress
- Evidence records (non-secret), run outcomes and scores, and maturity derived from run history
- The legacy adapter for existing consoles
- Example and conformance packs

## Out of Scope

- Operational runbook content for other systems: it lives in the owning repo's `runbooks/`
- Storing, collecting or transmitting secrets
- Executing steps against infrastructure by default (guide first; execution is opt-in per step and audited)
- Task tracking (State Hub and workplans)
- Provider or tenant policy decisions

## Current State

- Status: bootstrap. Specification and workplans are being written; extraction of the
  console from `net-kingdom` (`tools/security-bootstrap-console/`) is planned in
  `workplans/`.

## Getting Oriented

- Direction: `INTENT.md`
- Pack specification: `docs/pack-spec.md`
- Work state: `.custodian-brief.md` and `workplans/`