From 092c3553771cf202c23379d8ad14bd6796894af7 Mon Sep 17 00:00:00 2001 From: Bartek Kus <7887446+bartekus@users.noreply.github.com> Date: Wed, 15 Jul 2026 01:19:11 -0600 Subject: [PATCH 1/3] chore(claude): drop blanket Write(**) from the allow list Leaves Edit(**) allowed; Write now prompts. Author: repo owner. --- .claude/settings.json | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/.claude/settings.json b/.claude/settings.json index 9c9b8eb..4b432b5 100644 --- a/.claude/settings.json +++ b/.claude/settings.json @@ -22,8 +22,7 @@ "Bash(grep *)", "Bash(rg *)", "Read(**)", - "Edit(**)", - "Write(**)" + "Edit(**)" ], "deny": [ "Bash(cargo publish*)", From a713340b722f7fb9ae68c8dd3f76000894f28ad7 Mon Sep 17 00:00:00 2001 From: Bartek Kus <7887446+bartekus@users.noreply.github.com> Date: Wed, 15 Jul 2026 01:19:21 -0600 Subject: [PATCH 2/3] feat(002): add tenant-emit and tenant-tail to the product family Both are public Apache-2.0 repos under stagecraft-ing: tenant-emit signs a produced app's governance certificate, tenant-tail re-verifies the factory's run-side paperwork with no trust in the producer. They join the family list (footer + README + REPO_META/PRODUCT_FAMILY) and spec 002 section 2, dated 2026-07-15. Like spec-spine, they are named and linked but not added to the /registry bake set (spec 001), so the baked payload is unchanged. Roles and licenses are checkable against each repo's README and LICENSE. app/lib/product-family.ts is owned by spec 001 via its app/ directory, so the coupling gate flags it; the authoring edit lives in the content owner (spec 002 section 2) and spec 001 is deliberately untouched. Waived in the PR body per the adversarial-refusal rule. --- .../by-package/stagecraft-ing.json | 2 +- .../codebase-index/by-spec/000-bootstrap.json | 2 +- .../by-spec/001-site-scaffold.json | 2 +- .../by-spec/002-launch-content.json | 2 +- .../by-spec/002-launch-content.json | 2 +- README.md | 5 +++++ app/lib/product-family.ts | 18 +++++++++++++++++- specs/002-launch-content/spec.md | 10 ++++++++-- 8 files changed, 35 insertions(+), 8 deletions(-) diff --git a/.derived/codebase-index/by-package/stagecraft-ing.json b/.derived/codebase-index/by-package/stagecraft-ing.json index 56ea398..3135379 100644 --- a/.derived/codebase-index/by-package/stagecraft-ing.json +++ b/.derived/codebase-index/by-package/stagecraft-ing.json @@ -5,5 +5,5 @@ "path": "" }, "schemaVersion": "1.1.0", - "shardHash": "6d1c8392a8d1d98ca723542d04780476c5faf043204703d79f42cb41a229beee" + "shardHash": "332c69f0508aa2a0fad69e29fff540bb2ba48a94b8518069eb9f0d11a2b69b91" } diff --git a/.derived/codebase-index/by-spec/000-bootstrap.json b/.derived/codebase-index/by-spec/000-bootstrap.json index 6f5d04f..226dcd4 100644 --- a/.derived/codebase-index/by-spec/000-bootstrap.json +++ b/.derived/codebase-index/by-spec/000-bootstrap.json @@ -42,5 +42,5 @@ "specStatus": "approved" }, "schemaVersion": "1.1.0", - "shardHash": "2bec351256eae4bc6941a9550bfffcd304cb6604640d97b85f6bf22cb37697b6" + "shardHash": "3e2458441b3b86df587e96c7d73ee9a2e5f88d4018edd7313ceb078e392d9f56" } diff --git a/.derived/codebase-index/by-spec/001-site-scaffold.json b/.derived/codebase-index/by-spec/001-site-scaffold.json index 9e8b05b..4e3f292 100644 --- a/.derived/codebase-index/by-spec/001-site-scaffold.json +++ b/.derived/codebase-index/by-spec/001-site-scaffold.json @@ -130,5 +130,5 @@ "specStatus": "approved" }, "schemaVersion": "1.1.0", - "shardHash": "a59ba7df3d5e808be8ba7da7af07cf850187cb11700e942ebe6a2a2988818926" + "shardHash": "56b49c1558488eab3f5cb972d30096fed9b7246bc09971f4166dbad291128d44" } diff --git a/.derived/codebase-index/by-spec/002-launch-content.json b/.derived/codebase-index/by-spec/002-launch-content.json index 1194314..c5d3bae 100644 --- a/.derived/codebase-index/by-spec/002-launch-content.json +++ b/.derived/codebase-index/by-spec/002-launch-content.json @@ -96,5 +96,5 @@ "specStatus": "approved" }, "schemaVersion": "1.1.0", - "shardHash": "b89aa769c2379525b9536a49fe574bfcb8244e05beca67bf76c014551f112e07" + "shardHash": "392db15f8d62d2b6acb0d394e99e11e082b857a136c0b50bf91e9aff3d69b4aa" } diff --git a/.derived/spec-registry/by-spec/002-launch-content.json b/.derived/spec-registry/by-spec/002-launch-content.json index 3bdce1f..6d11877 100644 --- a/.derived/spec-registry/by-spec/002-launch-content.json +++ b/.derived/spec-registry/by-spec/002-launch-content.json @@ -43,6 +43,6 @@ "summary": "The words on the site at launch. One index page that states what Stagecraft is in the builder's own register (creator-led, OSS-credible, no startup theater), a product-family section mapping the four repos and their licenses, and an honest status section tied to the public milestone ladder. The positioning facts are inlined here so the implementing session needs no external archive.\n", "title": "Launch content: positioning, product family, honest status" }, - "shardHash": "7b9884fbd42e2bae5bd569294aeb0c596cbb29e0efa1290cd3777ece462cd6b3", + "shardHash": "aeb025389f74a8869133548e2896f316b0d3f7bdb8de6ddf3585a74e1da43635", "specVersion": "1.1.0" } diff --git a/README.md b/README.md index fb54363..a72643d 100644 --- a/README.md +++ b/README.md @@ -11,6 +11,11 @@ the governed agentic delivery control plane, and its product family: CLI + MCP server (Apache-2.0) - [spec-spine](https://github.com/stagecraft-ing/spec-spine): the spec-governance toolchain everything above is governed by +- [tenant-emit](https://github.com/stagecraft-ing/tenant-emit): the tenant + certificate emitter, signing a produced app's governance certificate (Apache-2.0) +- [tenant-tail](https://github.com/stagecraft-ing/tenant-tail): the tenant + certificate verifier, re-checking the factory's paperwork with no trust in + the producer (Apache-2.0) Site content and stack land here later; this placeholder marks the repo's role (the dotted-name convention: this repo is the website). diff --git a/app/lib/product-family.ts b/app/lib/product-family.ts index 60c8211..da98ec0 100644 --- a/app/lib/product-family.ts +++ b/app/lib/product-family.ts @@ -49,6 +49,20 @@ export const REPO_META: Record = { role: "the spec-governance toolchain everything above is governed by", url: `${ORG_URL}/spec-spine`, }, + "tenant-emit": { + repo: "tenant-emit", + name: "tenant-emit", + license: "Apache-2.0", + role: "the tenant certificate emitter: signs a produced app's governance certificate", + url: `${ORG_URL}/tenant-emit`, + }, + "tenant-tail": { + repo: "tenant-tail", + name: "tenant-tail", + license: "Apache-2.0", + role: "the tenant certificate verifier: re-checks the factory's paperwork, no trust in the producer", + url: `${ORG_URL}/tenant-tail`, + }, "stagecraft.ing": { repo: "stagecraft.ing", name: "stagecraft.ing", @@ -58,12 +72,14 @@ export const REPO_META: Record = { }, }; -// The four repos shown as the product family in the footer (README order). +// The repos shown as the product family in the footer (README order). export const PRODUCT_FAMILY: RepoMeta[] = [ REPO_META["stagecraft"], REPO_META["enrahitu"], REPO_META["stagecraft-cli"], REPO_META["spec-spine"], + REPO_META["tenant-emit"], + REPO_META["tenant-tail"], ]; export function repoMeta(repo: string): RepoMeta | undefined { diff --git a/specs/002-launch-content/spec.md b/specs/002-launch-content/spec.md index 9eaa046..83dbb1c 100644 --- a/specs/002-launch-content/spec.md +++ b/specs/002-launch-content/spec.md @@ -75,8 +75,14 @@ reads naturally (a single creator builds this in the open). - **Product family table**: stagecraft (control plane, AGPL-3.0), enrahitu (template chassis, Apache-2.0), stagecraft-cli (CLI + MCP server, Apache-2.0), spec-spine (governance toolchain, its own - repo). Each row: one-line role + repo link + license, and the note - that stamped apps belong to their owners. + repo), and (added 2026-07-15) the two vended tenant tools + tenant-emit (the certificate emitter) and tenant-tail (the + certificate verifier), both Apache-2.0. Each row: one-line role + + repo link + license, and the note that stamped apps belong to their + owners. Like spec-spine, the tenant tools appear in this family list + but are not baked into the `/registry` viewer: §1 (spec 001) leaves + the bake set unchanged, so they are named and linked, not rendered as + spec corpora. - **For agents**: a short section stating the MCP face: coding agents operate under the same governance as humans (same verbs, same guards, explicit posture, no side doors). From 9041c724e47a611dd5066c6a4d9912e6edd1b84c Mon Sep 17 00:00:00 2001 From: Bartek Kus <7887446+bartekus@users.noreply.github.com> Date: Wed, 15 Jul 2026 01:33:45 -0600 Subject: [PATCH 3/3] feat(002): add action-gate, attest-ledger, canonical-keysort-json, trust-window to the family Four more public Apache-2.0 repos under stagecraft-ing, the OAP-extracted primitives: action-gate (deterministic decision gate), attest-ledger (tamper-evident record ledger), canonical-keysort-json (canonical JSON at the hash boundary), trust-window (rolling-window trust scorer). Roles/licenses are checkable against each repo's README/LICENSE and GitHub description. Same treatment as the tenant tools and spec-spine: named + linked in the family list (footer + README + REPO_META/PRODUCT_FAMILY) and recorded in spec 002 section 2, not added to the /registry bake set. Verified: the baked payload's repo set stays the original four; the footer now renders all 10 family repos. Coupling drift on app/lib/product-family.ts (spec-001-owned by directory) is covered by the PR-body Spec-Drift-Waiver already in place. --- .../by-spec/002-launch-content.json | 2 +- .../by-spec/002-launch-content.json | 2 +- README.md | 12 +++++++ app/lib/product-family.ts | 32 +++++++++++++++++++ specs/002-launch-content/spec.md | 19 ++++++----- 5 files changed, 57 insertions(+), 10 deletions(-) diff --git a/.derived/codebase-index/by-spec/002-launch-content.json b/.derived/codebase-index/by-spec/002-launch-content.json index c5d3bae..8071c30 100644 --- a/.derived/codebase-index/by-spec/002-launch-content.json +++ b/.derived/codebase-index/by-spec/002-launch-content.json @@ -96,5 +96,5 @@ "specStatus": "approved" }, "schemaVersion": "1.1.0", - "shardHash": "392db15f8d62d2b6acb0d394e99e11e082b857a136c0b50bf91e9aff3d69b4aa" + "shardHash": "8d4aaf89704833f99fdae50f620b20d2c915db16625ee74fd548c31255c3f73e" } diff --git a/.derived/spec-registry/by-spec/002-launch-content.json b/.derived/spec-registry/by-spec/002-launch-content.json index 6d11877..e980130 100644 --- a/.derived/spec-registry/by-spec/002-launch-content.json +++ b/.derived/spec-registry/by-spec/002-launch-content.json @@ -43,6 +43,6 @@ "summary": "The words on the site at launch. One index page that states what Stagecraft is in the builder's own register (creator-led, OSS-credible, no startup theater), a product-family section mapping the four repos and their licenses, and an honest status section tied to the public milestone ladder. The positioning facts are inlined here so the implementing session needs no external archive.\n", "title": "Launch content: positioning, product family, honest status" }, - "shardHash": "aeb025389f74a8869133548e2896f316b0d3f7bdb8de6ddf3585a74e1da43635", + "shardHash": "f36fb21c54684c5b6c72484889ad5cfcc6f660be6962d8e1fb62625012f8aaf1", "specVersion": "1.1.0" } diff --git a/README.md b/README.md index a72643d..2425232 100644 --- a/README.md +++ b/README.md @@ -16,6 +16,18 @@ the governed agentic delivery control plane, and its product family: - [tenant-tail](https://github.com/stagecraft-ing/tenant-tail): the tenant certificate verifier, re-checking the factory's paperwork with no trust in the producer (Apache-2.0) +- [action-gate](https://github.com/stagecraft-ing/action-gate): a pure, + deterministic decision gate, evaluate(context, checks) returning Allow, Deny, + or Degrade (Apache-2.0) +- [attest-ledger](https://github.com/stagecraft-ing/attest-ledger): a + tamper-evident record ledger, append-only, hash-linked, Ed25519-signed, with + an independent verifier (Apache-2.0) +- [canonical-keysort-json](https://github.com/stagecraft-ing/canonical-keysort-json): + deterministic canonical JSON, a lexicographic key sort at the serialization + boundary so record hashes agree (Apache-2.0) +- [trust-window](https://github.com/stagecraft-ing/trust-window): a + rolling-window trust scorer, weighted samples mapping to a graduated privilege + level (Apache-2.0) Site content and stack land here later; this placeholder marks the repo's role (the dotted-name convention: this repo is the website). diff --git a/app/lib/product-family.ts b/app/lib/product-family.ts index da98ec0..f3038e4 100644 --- a/app/lib/product-family.ts +++ b/app/lib/product-family.ts @@ -63,6 +63,34 @@ export const REPO_META: Record = { role: "the tenant certificate verifier: re-checks the factory's paperwork, no trust in the producer", url: `${ORG_URL}/tenant-tail`, }, + "action-gate": { + repo: "action-gate", + name: "action-gate", + license: "Apache-2.0", + role: "a pure, deterministic decision gate: evaluate(context, checks) returns Allow, Deny, or Degrade", + url: `${ORG_URL}/action-gate`, + }, + "attest-ledger": { + repo: "attest-ledger", + name: "attest-ledger", + license: "Apache-2.0", + role: "a tamper-evident record ledger: append-only, hash-linked, Ed25519-signed, with an independent verifier", + url: `${ORG_URL}/attest-ledger`, + }, + "canonical-keysort-json": { + repo: "canonical-keysort-json", + name: "canonical-keysort-json", + license: "Apache-2.0", + role: "deterministic canonical JSON: a lexicographic key sort at the serialization boundary, so record hashes agree", + url: `${ORG_URL}/canonical-keysort-json`, + }, + "trust-window": { + repo: "trust-window", + name: "trust-window", + license: "Apache-2.0", + role: "a rolling-window trust scorer: weighted samples map to a graduated privilege level", + url: `${ORG_URL}/trust-window`, + }, "stagecraft.ing": { repo: "stagecraft.ing", name: "stagecraft.ing", @@ -80,6 +108,10 @@ export const PRODUCT_FAMILY: RepoMeta[] = [ REPO_META["spec-spine"], REPO_META["tenant-emit"], REPO_META["tenant-tail"], + REPO_META["action-gate"], + REPO_META["attest-ledger"], + REPO_META["canonical-keysort-json"], + REPO_META["trust-window"], ]; export function repoMeta(repo: string): RepoMeta | undefined { diff --git a/specs/002-launch-content/spec.md b/specs/002-launch-content/spec.md index 83dbb1c..5e11350 100644 --- a/specs/002-launch-content/spec.md +++ b/specs/002-launch-content/spec.md @@ -75,14 +75,17 @@ reads naturally (a single creator builds this in the open). - **Product family table**: stagecraft (control plane, AGPL-3.0), enrahitu (template chassis, Apache-2.0), stagecraft-cli (CLI + MCP server, Apache-2.0), spec-spine (governance toolchain, its own - repo), and (added 2026-07-15) the two vended tenant tools - tenant-emit (the certificate emitter) and tenant-tail (the - certificate verifier), both Apache-2.0. Each row: one-line role + - repo link + license, and the note that stamped apps belong to their - owners. Like spec-spine, the tenant tools appear in this family list - but are not baked into the `/registry` viewer: §1 (spec 001) leaves - the bake set unchanged, so they are named and linked, not rendered as - spec corpora. + repo), and (added 2026-07-15) six more public repos, all Apache-2.0: + the vended tenant tools tenant-emit (the certificate emitter) and + tenant-tail (the certificate verifier), plus the extracted primitives + action-gate (the deterministic decision gate), attest-ledger (the + tamper-evident record ledger), canonical-keysort-json (canonical JSON + at the hash boundary), and trust-window (the rolling-window trust + scorer). Each row: one-line role + repo link + license, and the note + that stamped apps belong to their owners. Like spec-spine, these + repos appear in this family list but are not baked into the + `/registry` viewer: §1 (spec 001) leaves the bake set unchanged, so + they are named and linked, not rendered as spec corpora. - **For agents**: a short section stating the MCP face: coding agents operate under the same governance as humans (same verbs, same guards, explicit posture, no side doors).