Skip to content

feat(002): expand the product family (tenant tools + 4 OAP primitives)#2

Merged
bartekus merged 3 commits into
mainfrom
feat/002-tenant-tools-family
Jul 15, 2026
Merged

feat(002): expand the product family (tenant tools + 4 OAP primitives)#2
bartekus merged 3 commits into
mainfrom
feat/002-tenant-tools-family

Conversation

@bartekus

@bartekus bartekus commented Jul 15, 2026

Copy link
Copy Markdown
Contributor

Summary

Expands the Stagecraft product family shown on the site from four repos to ten. All additions are public Apache-2.0 repos under stagecraft-ing, named and linked in the family list but NOT added to the /registry bake set (exactly like spec-spine), so the baked registry payload is unchanged.

Vended tenant tools:

  • tenant-emit: signs a produced app's governance certificate.
  • tenant-tail: re-verifies the factory's run-side paperwork with no trust in the producer.

OAP-extracted primitives:

  • action-gate: a pure, deterministic decision gate (Allow / Deny / Degrade).
  • attest-ledger: a tamper-evident, hash-linked, Ed25519-signed record ledger with an independent verifier.
  • canonical-keysort-json: deterministic canonical JSON at the hash boundary.
  • trust-window: a rolling-window trust scorer with graduated privilege output.

They join the footer product-family list, the README ecosystem list, and REPO_META/PRODUCT_FAMILY in app/lib/product-family.ts. Spec 002 section 2 records the expanded family (dated 2026-07-15). Also included: a small chore commit dropping blanket Write(**) from the .claude/settings.json allow list (the repo owner's own change).

Testing

  • spec-spine compile / index / lint --fail-on-warn / index check: all green.
  • npm run typecheck: clean.
  • npm run build: clean; the prerendered footer renders all 10 family repos; the baked payload's repo set stays the original four (enrahitu, stagecraft, stagecraft-cli, stagecraft.ing) and none of the new repos are baked as corpora.
  • Roles and licenses are checkable against each repo's README, LICENSE, and GitHub description.

Coupling

Spec-Drift-Waiver: app/lib/product-family.ts is spec-001-owned by directory (app/); the authoring edit for this family-list change lives in the content owner, spec 002 section 2. Spec 001 (scaffold) is intentionally not re-authored, per .claude/rules/adversarial-prompt-refusal.md.

bartekus added 3 commits July 15, 2026 01:19
Leaves Edit(**) allowed; Write now prompts. Author: repo owner.
Both are public Apache-2.0 repos under stagecraft-ing: tenant-emit signs a
produced app's governance certificate, tenant-tail re-verifies the factory's
run-side paperwork with no trust in the producer. They join the family list
(footer + README + REPO_META/PRODUCT_FAMILY) and spec 002 section 2, dated
2026-07-15.

Like spec-spine, they are named and linked but not added to the /registry
bake set (spec 001), so the baked payload is unchanged. Roles and licenses
are checkable against each repo's README and LICENSE.

app/lib/product-family.ts is owned by spec 001 via its app/ directory, so the
coupling gate flags it; the authoring edit lives in the content owner (spec
002 section 2) and spec 001 is deliberately untouched. Waived in the PR body
per the adversarial-refusal rule.
…ust-window to the family

Four more public Apache-2.0 repos under stagecraft-ing, the OAP-extracted
primitives: action-gate (deterministic decision gate), attest-ledger
(tamper-evident record ledger), canonical-keysort-json (canonical JSON at the
hash boundary), trust-window (rolling-window trust scorer). Roles/licenses are
checkable against each repo's README/LICENSE and GitHub description.

Same treatment as the tenant tools and spec-spine: named + linked in the family
list (footer + README + REPO_META/PRODUCT_FAMILY) and recorded in spec 002
section 2, not added to the /registry bake set. Verified: the baked payload's
repo set stays the original four; the footer now renders all 10 family repos.

Coupling drift on app/lib/product-family.ts (spec-001-owned by directory) is
covered by the PR-body Spec-Drift-Waiver already in place.
@bartekus bartekus changed the title feat(002): add tenant-emit and tenant-tail to the product family feat(002): expand the product family (tenant tools + 4 OAP primitives) Jul 15, 2026
@bartekus
bartekus merged commit 8d0aad6 into main Jul 15, 2026
1 check passed
@bartekus
bartekus deleted the feat/002-tenant-tools-family branch July 15, 2026 07:35
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant