From e8bd394c8b79741a4bb3b1d09c8b495ca41d7c0f Mon Sep 17 00:00:00 2001 From: codex Date: Wed, 14 Oct 2026 06:46:30 +0200 Subject: [PATCH] docs(reuse): establish reviewed NetKingdom security capabilities --- ...bility.agents.custodian-runtime-tooling.md | 125 +++++++++--------- registry/indexes/capabilities.yaml | 19 +-- 2 files changed, 71 insertions(+), 73 deletions(-) diff --git a/registry/capabilities/capability.agents.custodian-runtime-tooling.md b/registry/capabilities/capability.agents.custodian-runtime-tooling.md index a07a42b..3c0f896 100644 --- a/registry/capabilities/capability.agents.custodian-runtime-tooling.md +++ b/registry/capabilities/capability.agents.custodian-runtime-tooling.md @@ -1,9 +1,7 @@ --- id: capability.agents.custodian-runtime-tooling -name: Custodian Runtime And Repo-Classification Tooling -summary: 'Generic tooling from The Custodian''s runtime and ecosystem-management surface: an agent runtime - framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across - the workstation''s 61 repos.' +name: Generic agent runtime and repository tooling +summary: Agent runtime modules and repository classification tooling. owner: the-custodian status: draft domain: custodian @@ -11,23 +9,26 @@ tags: - agents - runtime - classification +- security +- netkingdom +- framework-reuse maturity: discovery: current: D2 target: D4 confidence: medium - rationale: This repo's README and canon content are marked confidential/proprietary; this entry deliberately - scopes to the generic, non-proprietary tooling surface only (runtime/ agent framework, tools/ classification - scripts), which is separately reusable and does not disclose canon/memory contents. + rationale: This repo's README and canon content are marked confidential/proprietary; + this entry deliberately scopes to the generic, non-proprietary tooling surface + only (runtime/ agent framework, tools/ classification scripts), which is separately + reusable and does not disclose canon/memory contents. availability: - current: A1 + current: A2 target: A2 confidence: medium - rationale: '`runtime/agent.py` plus context/actions/tool_adapters/policies modules form a real Python - package (own pyproject, tests, README) under `runtime/`; `tools/` holds standalone scripts (batch_author_repo_classifications.py, - human_review_classifications.py, validate_repo_classification.py, push_repo_classifications.sh, - patch-forgejo-remote-urls.sh) used for ecosystem-wide repo classification and the Gitea-to-Forgejo - remote URL migration.' + rationale: 'Source interface assessed 2026-10-14: Agent runtime modules and repository + classification tooling. Availability describes the delivery form, not production + acceptance. Only generic tooling is reusable; confidential canon and session + memory are excluded.' external_evidence: completeness: level: C1 @@ -35,7 +36,8 @@ external_evidence: basis: scope_vs_intent_and_consumer_expectations satisfied_expectations: - standalone agent-runtime package under runtime/ with its own tests - - repo-classification batch/review/validate/push scripts used across the workstation roster + - repo-classification batch/review/validate/push scripts used across the workstation + roster - a patch-forgejo-remote-urls.sh script directly relevant to REUSE-WP-0019 broken_expectations: [] out_of_scope_expectations: [] @@ -44,37 +46,36 @@ external_evidence: confidence: low basis: consumer_quality_signals known_reliability_risks: - - repo root is confidential/proprietary (NDA); this entry's scope is deliberately narrow and must - not be widened to canon/memory contents without explicit review + - repo root is confidential/proprietary (NDA); this entry's scope is deliberately + narrow and must not be widened to canon/memory contents without explicit review discovery: - intent: Expose only the generic, non-confidential tooling that emerged from The Custodian's ecosystem-management - work — an agent runtime framework and repo-classification batch tooling — as reusable, without describing - canon or memory content. + intent: Agent runtime modules and repository classification tooling includes: - - runtime/ agent framework (context, actions, tool adapters, policies) - - repo-classification batch/review/validate/push scripts - - patch-forgejo-remote-urls.sh + - Agent runtime modules and repository classification tooling excludes: - - canon/ (curated knowledge substrate) and memory/ (operational logs) — confidential, out of registry - scope entirely - - governance/constitution content + - Only generic tooling is reusable; confidential canon and session memory are excluded assumptions: [] - use_cases: [] + use_cases: + - 'U09: Maintainer observes posture, prioritizes findings, coordinates work and + verifies outcomes' + - 'U11: Agent executes an attributable bounded task and supplies supervision evidence' + - 'U14: Framework adopter validates and reuses selected contracts, tools and reference + compositions' research_memos: [] availability: - current_level: A1 + current_level: A2 target_level: A2 current_artifacts: - - '`runtime/` Python package' - - '`tools/*.py` and `tools/*.sh` classification scripts' + - runtime/README.md target_artifacts: [] consumption_modes: - - library import (runtime/) - - cli (tools/ scripts) + - CLI + - source relations: depends_on: [] supports: [] - related_to: [] + related_to: + - capability.security.iam-tooling-suite evidence: documentation: - runtime/README.md @@ -85,47 +86,43 @@ evidence: incidents: [] consumer_guidance: recommended_for: - - ecosystem-management tooling reuse (repo classification batching, Forgejo remote-URL migration) — - not for canon/governance content, which is out of scope + - Maintainer observes posture, prioritizes findings, coordinates work and verifies + outcomes + - Agent executes an attributable bounded task and supplies supervision evidence + - Framework adopter validates and reuses selected contracts, tools and reference + compositions not_recommended_for: - - any attempt to reuse or reference canon/memory contents (confidential, NDA-protected, explicitly excluded - from this entry) + - Only generic tooling is reusable; confidential canon and session memory are excluded known_limitations: - - registry entry intentionally narrow; confidentiality boundary must be respected in any future promotion -promotion_history: [] + - Only generic tooling is reusable; confidential canon and session memory are excluded + - 2026-10-14 architecture review estimates operational maturity separately; a registry + entry does not authorize execution or establish deployment. +promotion_history: +- date: '2026-10-14' + dimension: availability + from: A1 + to: A2 + rationale: Interface-form reassessment from current owner sources; no completeness/reliability + promotion. + author: codex --- -# Custodian Runtime And Repo-Classification Tooling +# Generic agent runtime and repository tooling -## Overview +Agent runtime modules and repository classification tooling. -The Custodian's repository root is confidential and proprietary. This capability entry deliberately scopes only to its generic, non-confidential tooling surface: the `runtime/` agent framework (context, actions, tool adapters, policies) and the `tools/` repo-classification batch/review/validate/push scripts — including `patch-forgejo-remote-urls.sh`, directly relevant to the ecosystem's Gitea-to-Forgejo transition. Canon and memory content are explicitly excluded from this entry. +## Reuse boundary -## Assessment notes +Only generic tooling is reusable; confidential canon and session memory are excluded. -### Discovery +## Supported use cases -This repo's README and canon content are marked confidential/proprietary; this entry deliberately scopes to the generic, non-proprietary tooling surface only (runtime/ agent framework, tools/ classification scripts), which is separately reusable and does not disclose canon/memory contents. +- U09: Maintainer observes posture, prioritizes findings, coordinates work and verifies outcomes +- U11: Agent executes an attributable bounded task and supplies supervision evidence +- U14: Framework adopter validates and reuses selected contracts, tools and reference compositions -### Availability +## Evidence and integration -`runtime/agent.py` plus context/actions/tool_adapters/policies modules form a real Python package (own pyproject, tests, README) under `runtime/`; `tools/` holds standalone scripts (batch_author_repo_classifications.py, human_review_classifications.py, validate_repo_classification.py, push_repo_classifications.sh, patch-forgejo-remote-urls.sh) used for ecosystem-wide repo classification and the Gitea-to-Forgejo remote URL migration. +- [runtime/README.md](../../runtime/README.md) -### Completeness - -First-pass honest assessment from the REUSE-WP-0017 coverage campaign -(reuse-surface). No external consumer feedback exists yet; levels reflect -scope-vs-intent documentation quality, not internal code quality. - -### Reliability - -No production consumer telemetry exists yet; reliability level is -intentionally conservative pending REUSE-WP-0019 reuse-telemetry evidence. - -## Promotion checklist - -- [x] ID follows `capability..` pattern -- [x] Maturity enums match `specs/CapabilityMaturityStandard.md` -- [x] `external_evidence` is populated separately from `maturity` -- [ ] Relations reference valid capability IDs (none yet) -- [x] Index entry added in `registry/indexes/capabilities.yaml` +Assessment: CUST-WP-0081, 2026-10-14. Relations identify interfaces to compose; they do not certify native integration. Existing external evidence levels are retained where present. New entries use conservative C1/R0 until consumer assessment exists. diff --git a/registry/indexes/capabilities.yaml b/registry/indexes/capabilities.yaml index 112e727..bb5b80e 100644 --- a/registry/indexes/capabilities.yaml +++ b/registry/indexes/capabilities.yaml @@ -1,21 +1,22 @@ version: 1 -updated: '2026-07-06' +updated: '2026-10-14' domain: helix_forge capabilities: - id: capability.agents.custodian-runtime-tooling - name: Custodian Runtime And Repo-Classification Tooling - summary: 'Generic tooling from The Custodian''s runtime and ecosystem-management surface: an agent runtime - framework (context, actions, tool adapters, policies) and repo-classification batch tooling used across - the workstation''s 61 repos.' - vector: D2 / A1 / C1 / R0 + name: Generic agent runtime and repository tooling + summary: Agent runtime modules and repository classification tooling. domain: custodian status: draft owner: the-custodian - path: registry/capabilities/capability.agents.custodian-runtime-tooling.md tags: - agents - runtime - classification + - security + - netkingdom + - framework-reuse + vector: D2 / A2 / C1 / R0 + path: registry/capabilities/capability.agents.custodian-runtime-tooling.md consumption_modes: - - library import (runtime/) - - cli (tools/ scripts) + - CLI + - source