docs: Control Tower 0.9.0 runbooks compatibility

profile/README.md

@@ -31,7 +31,7 @@ Every component is independently usable. None of them require each other, and an
 | [**Agentic Sidecar**](https://github.com/DeepAgentLabs/agentic-sidecar) (`agentic-sidecar`) | A real-time supervision layer that checks an agent's plans and actions against intent, policy, risk, and budget before they execute. |
 | [**Agentic Chaos**](https://github.com/DeepAgentLabs/agentic-chaos) (`agentic-chaos`) | A fault-injection toolkit that deliberately breaks agent workflows to measure resilience and recovery, with circuit breakers and dry-run previews (0.5.2), AgenticLens diagnosis span markers (0.5.3), a pytest plugin with fail-closed resilience contracts (0.6.0), cascades, threshold search, synthetic response poisoning and cost estimates (0.7.0), gated multi-stage chaos workflows, linted declarative experiments, explosion-radius scopes and topology fuzzing (0.8.0), and pre/during/post resilience probes with a 0–100 resilience score, bounded score trends and a `--min-score` CI gate (0.9.0). |
 | [**MCP Server**](https://github.com/DeepAgentLabs/mcp-server) (`deep-agentic-core-mcp`) | A single MCP interface that exposes workflow inspection, evaluation, and chaos/resilience tooling to AI clients. |
-| [**AgenticOps Control Tower**](https://github.com/DeepAgentLabs/agenticops-control-tower) | An operations control plane for inventory, evidence posture, cited MCP investigation and approved verified staging recovery (0.6.0), plus approved fleet desired settings and bounded stop/MCP-revocation coordination (0.7.0), periodic local detection, durable alerts and joined incident console views (0.8.0). |
+| [**AgenticOps Control Tower**](https://github.com/DeepAgentLabs/agenticops-control-tower) | An operations control plane for inventory, evidence posture, cited MCP investigation and approved verified staging recovery (0.6.0), plus approved fleet desired settings and bounded stop/MCP-revocation coordination (0.7.0), periodic local detection, durable alerts and joined incident console views (0.8.0), and versioned runbooks with exact-digest approval, bounded steps, compensation and verified recovery (0.9.0). |
 
 See the [roadmap](ROADMAP.md) for how these pieces fit together and what's being built next.
 
@@ -342,3 +342,11 @@ documentation only, with no dependency or pin changes. Next for MCP is Phase 6:
 hosted Tower credentials, an authenticated Sidecar stop/revoke bridge and a
 shared AIOS access-evidence format. See the
 [hosted access control guide](https://github.com/DeepAgentLabs/mcp-server/blob/v0.5.0/docs/access-control.md).
+
+## Control Tower 0.9.0 runbooks
+
+See [operator compatibility and ownership](tower-0.9-runbooks.md) for versioned runbooks,
+exact-digest approval, bounded steps, compensation, cancellation and verified
+recovery. Existing native contracts and optional dependency ranges remain
+compatible. MCP 0.5.1 adds local `tower.runbook*` tools; the other siblings need
+documentation only.

profile/ROADMAP.md

@@ -287,8 +287,9 @@ copilot, human approvals, automated runbooks and verified recovery.
 The first approved incident-to-recovery staging scenario ships with the local MCP
 investigation connector in Tower 0.6.0 (Phase 6 and 6A combined). The supported
 runtime is a deterministic dependency fixture. Tower 0.8.0 adds periodic local
-detection, durable alerts and incident console views; reusable production runbooks
-remain v0.9 work. Tower coordinates them while Lens,
+detection, durable alerts and incident console views; Tower 0.9.0 adds reusable
+versioned runbooks for the staging fixture, and production runtime connectors remain
+planned. Tower coordinates them while Lens,
 Evals, Sidecar and Chaos retain their engines.
 
 AgenticOps Control Tower should not replace Lens, Chaos, Sidecar, or MCP. It should centralize:
@@ -998,3 +999,14 @@ documentation only, with no dependency or pin changes. Next for MCP is Phase 6:
 hosted Tower credentials, an authenticated Sidecar stop/revoke bridge and a
 shared AIOS access-evidence format. See the
 [hosted access control guide](https://github.com/DeepAgentLabs/mcp-server/blob/v0.5.0/docs/access-control.md).
+
+## Control Tower 0.9.0 integration alignment
+
+Tower Phase 9 implements versioned runbooks with exact-digest approval, bounded
+steps, compensation, cancellation, lease-based reconciliation and verified
+recovery. Chaos reports are read only as runbook validation evidence, Evals gates
+as validation and recovery evidence, and Lens runs as recovery evidence. MCP 0.5.1
+adds local `tower.runbook*` tools; approval stays human-only.
+
+See [compatibility and operator example](tower-0.9-runbooks.md).
+MCP needs a patch release (0.5.1); the other siblings need documentation only.

profile/tower-0.9-runbooks.md

@@ -0,0 +1,40 @@
+# Control Tower 0.9.0 runbooks compatibility
+
+Control Tower 0.9.0 adds versioned runbooks and recovery workflows. Installed
+runbook versions are immutable and declare prerequisites, named string parameters
+(each constrained by a pattern, length and optional allowed list) and ordered steps with per-step timeouts, retry limits and optional rollback actions.
+Recommendations come only from installed versions. A writer previews an exact
+digest, a separate human approves it, and Tower claims each step before
+dispatching it to a host-installed connector. Clean failures retry within the step
+limit and then run declared rollback actions for completed steps; partial,
+timed-out or unknown outcomes stop for reconciliation without replay. A runbook
+resolves only after a connector probe, a fresh successful Lens run and a passing
+Evals gate for the same run. The supported runtime is a deterministic staging
+fixture; production runtime connectors are not included.
+
+Tower owns runbooks, approvals and incident coordination. Lens owns analysis; Evals
+owns scoring; Sidecar owns runtime enforcement; Chaos owns resilience testing;
+MCP owns tool exposure. AIOS remains the draft shared-semantics authority.
+
+Each sibling keeps its engine. Chaos reports are read only as runbook validation
+evidence, Evals gates as validation and recovery evidence, and Lens runs as
+recovery evidence.
+
+MCP 0.5.1 is a patch release that adds local `tower.runbook*` tools over the new
+routes; approval stays human-only. Lens, Evals, Chaos, Sidecar and AIOS need
+documentation only, with no dependency floor or native artifact change.
+
+## Example operator workflow
+
+```bash
+agenticops-control-tower --token reader-token runbooks recommend INCIDENT_ID
+agenticops-control-tower --token writer-token runbooks preview INCIDENT_ID preview.json
+agenticops-control-tower --token approver-token runbooks approval EXECUTION_ID approval.json
+agenticops-control-tower --token writer-token runbooks execute EXECUTION_ID execute.json
+agenticops-control-tower --token writer-token runbooks verify EXECUTION_ID verify.json
+```
+
+Use Tower's [runbook guide](https://github.com/DeepAgentLabs/agenticops-control-tower/blob/v0.9.0/docs/runbooks.md) for definitions, step outcomes,
+authorization, request bodies and limits, and its
+[standalone walkthrough](https://github.com/DeepAgentLabs/agenticops-control-tower/blob/v0.9.0/examples/runbook_recovery.py) for recovery,
+compensation and escalation without optional siblings.