feat(002): expand the product family (tenant tools + 4 OAP primitives)

.claude/settings.json

@@ -22,8 +22,7 @@
       "Bash(grep *)",
       "Bash(rg *)",
       "Read(**)",
-      "Edit(**)",
-      "Write(**)"
+      "Edit(**)"
     ],
     "deny": [
       "Bash(cargo publish*)",

.derived/codebase-index/by-package/stagecraft-ing.json

@@ -5,5 +5,5 @@
     "path": ""
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "6d1c8392a8d1d98ca723542d04780476c5faf043204703d79f42cb41a229beee"
+  "shardHash": "332c69f0508aa2a0fad69e29fff540bb2ba48a94b8518069eb9f0d11a2b69b91"
 }

.derived/codebase-index/by-spec/000-bootstrap.json

@@ -42,5 +42,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "2bec351256eae4bc6941a9550bfffcd304cb6604640d97b85f6bf22cb37697b6"
+  "shardHash": "3e2458441b3b86df587e96c7d73ee9a2e5f88d4018edd7313ceb078e392d9f56"
 }

.derived/codebase-index/by-spec/001-site-scaffold.json

@@ -130,5 +130,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "a59ba7df3d5e808be8ba7da7af07cf850187cb11700e942ebe6a2a2988818926"
+  "shardHash": "56b49c1558488eab3f5cb972d30096fed9b7246bc09971f4166dbad291128d44"
 }

.derived/codebase-index/by-spec/002-launch-content.json

@@ -96,5 +96,5 @@
     "specStatus": "approved"
   },
   "schemaVersion": "1.1.0",
-  "shardHash": "b89aa769c2379525b9536a49fe574bfcb8244e05beca67bf76c014551f112e07"
+  "shardHash": "8d4aaf89704833f99fdae50f620b20d2c915db16625ee74fd548c31255c3f73e"
 }

.derived/spec-registry/by-spec/002-launch-content.json

@@ -43,6 +43,6 @@
     "summary": "The words on the site at launch. One index page that states what Stagecraft is in the builder's own register (creator-led, OSS-credible, no startup theater), a product-family section mapping the four repos and their licenses, and an honest status section tied to the public milestone ladder. The positioning facts are inlined here so the implementing session needs no external archive.\n",
     "title": "Launch content: positioning, product family, honest status"
   },
-  "shardHash": "7b9884fbd42e2bae5bd569294aeb0c596cbb29e0efa1290cd3777ece462cd6b3",
+  "shardHash": "f36fb21c54684c5b6c72484889ad5cfcc6f660be6962d8e1fb62625012f8aaf1",
   "specVersion": "1.1.0"
 }

README.md

@@ -11,6 +11,23 @@ the governed agentic delivery control plane, and its product family:
   CLI + MCP server (Apache-2.0)
 - [spec-spine](https://github.com/stagecraft-ing/spec-spine): the
   spec-governance toolchain everything above is governed by
+- [tenant-emit](https://github.com/stagecraft-ing/tenant-emit): the tenant
+  certificate emitter, signing a produced app's governance certificate (Apache-2.0)
+- [tenant-tail](https://github.com/stagecraft-ing/tenant-tail): the tenant
+  certificate verifier, re-checking the factory's paperwork with no trust in
+  the producer (Apache-2.0)
+- [action-gate](https://github.com/stagecraft-ing/action-gate): a pure,
+  deterministic decision gate, evaluate(context, checks) returning Allow, Deny,
+  or Degrade (Apache-2.0)
+- [attest-ledger](https://github.com/stagecraft-ing/attest-ledger): a
+  tamper-evident record ledger, append-only, hash-linked, Ed25519-signed, with
+  an independent verifier (Apache-2.0)
+- [canonical-keysort-json](https://github.com/stagecraft-ing/canonical-keysort-json):
+  deterministic canonical JSON, a lexicographic key sort at the serialization
+  boundary so record hashes agree (Apache-2.0)
+- [trust-window](https://github.com/stagecraft-ing/trust-window): a
+  rolling-window trust scorer, weighted samples mapping to a graduated privilege
+  level (Apache-2.0)
 
 Site content and stack land here later; this placeholder marks the repo's
 role (the dotted-name convention: this repo is the website).

app/lib/product-family.ts

@@ -49,6 +49,48 @@ export const REPO_META: Record<string, RepoMeta> = {
     role: "the spec-governance toolchain everything above is governed by",
     url: `${ORG_URL}/spec-spine`,
   },
+  "tenant-emit": {
+    repo: "tenant-emit",
+    name: "tenant-emit",
+    license: "Apache-2.0",
+    role: "the tenant certificate emitter: signs a produced app's governance certificate",
+    url: `${ORG_URL}/tenant-emit`,
+  },
+  "tenant-tail": {
+    repo: "tenant-tail",
+    name: "tenant-tail",
+    license: "Apache-2.0",
+    role: "the tenant certificate verifier: re-checks the factory's paperwork, no trust in the producer",
+    url: `${ORG_URL}/tenant-tail`,
+  },
+  "action-gate": {
+    repo: "action-gate",
+    name: "action-gate",
+    license: "Apache-2.0",
+    role: "a pure, deterministic decision gate: evaluate(context, checks) returns Allow, Deny, or Degrade",
+    url: `${ORG_URL}/action-gate`,
+  },
+  "attest-ledger": {
+    repo: "attest-ledger",
+    name: "attest-ledger",
+    license: "Apache-2.0",
+    role: "a tamper-evident record ledger: append-only, hash-linked, Ed25519-signed, with an independent verifier",
+    url: `${ORG_URL}/attest-ledger`,
+  },
+  "canonical-keysort-json": {
+    repo: "canonical-keysort-json",
+    name: "canonical-keysort-json",
+    license: "Apache-2.0",
+    role: "deterministic canonical JSON: a lexicographic key sort at the serialization boundary, so record hashes agree",
+    url: `${ORG_URL}/canonical-keysort-json`,
+  },
+  "trust-window": {
+    repo: "trust-window",
+    name: "trust-window",
+    license: "Apache-2.0",
+    role: "a rolling-window trust scorer: weighted samples map to a graduated privilege level",
+    url: `${ORG_URL}/trust-window`,
+  },
   "stagecraft.ing": {
     repo: "stagecraft.ing",
     name: "stagecraft.ing",
@@ -58,12 +100,18 @@ export const REPO_META: Record<string, RepoMeta> = {
   },
 };
 
-// The four repos shown as the product family in the footer (README order).
+// The repos shown as the product family in the footer (README order).
 export const PRODUCT_FAMILY: RepoMeta[] = [
   REPO_META["stagecraft"],
   REPO_META["enrahitu"],
   REPO_META["stagecraft-cli"],
   REPO_META["spec-spine"],
+  REPO_META["tenant-emit"],
+  REPO_META["tenant-tail"],
+  REPO_META["action-gate"],
+  REPO_META["attest-ledger"],
+  REPO_META["canonical-keysort-json"],
+  REPO_META["trust-window"],
 ];
 
 export function repoMeta(repo: string): RepoMeta | undefined {

specs/002-launch-content/spec.md

@@ -75,8 +75,17 @@ reads naturally (a single creator builds this in the open).
 - **Product family table**: stagecraft (control plane, AGPL-3.0),
   enrahitu (template chassis, Apache-2.0), stagecraft-cli (CLI + MCP
   server, Apache-2.0), spec-spine (governance toolchain, its own
-  repo). Each row: one-line role + repo link + license, and the note
-  that stamped apps belong to their owners.
+  repo), and (added 2026-07-15) six more public repos, all Apache-2.0:
+  the vended tenant tools tenant-emit (the certificate emitter) and
+  tenant-tail (the certificate verifier), plus the extracted primitives
+  action-gate (the deterministic decision gate), attest-ledger (the
+  tamper-evident record ledger), canonical-keysort-json (canonical JSON
+  at the hash boundary), and trust-window (the rolling-window trust
+  scorer). Each row: one-line role + repo link + license, and the note
+  that stamped apps belong to their owners. Like spec-spine, these
+  repos appear in this family list but are not baked into the
+  `/registry` viewer: §1 (spec 001) leaves the bake set unchanged, so
+  they are named and linked, not rendered as spec corpora.
 - **For agents**: a short section stating the MCP face: coding agents
   operate under the same governance as humans (same verbs, same
   guards, explicit posture, no side doors).