{
  "version": "0.1.0",
  "updatedAt": "2026-06-19",
  "status": "draft-owner-confirmed",
  "summary": "Declarative assistant action registry. Actions route requests to app-owned adapters after ontology context resolution and policy checks.",
  "apps": [
    {
      "id": "hub",
      "name": "HUB / Launcher",
      "authorityEntityIds": ["hub.user", "hub.membership", "hub.invite", "hub.application_access"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "summary": "Owns platform entry access, clients, memberships, invites, service access matrix, and assistant access role assignments."
    },
    {
      "id": "ops",
      "name": "OPS Product",
      "authorityEntityIds": ["ops.workspace", "ops.project", "ops.card", "ops.workspace_member", "ops.project_member"],
      "adapterId": "adapter.ops.product_api",
      "summary": "Owns Operational Core workspace/project/card model and internal OPS roles."
    },
    {
      "id": "engine",
      "name": "ENGINE",
      "authorityEntityIds": ["engine.workflow_l1", "engine.workflow_acl", "engine.workflow_share"],
      "adapterId": "adapter.engine.workflow_api",
      "summary": "Owns workflow ACL, workflow sharing, and Engine runtime/workflow context."
    },
    {
      "id": "gateway",
      "name": "OPS Gateway",
      "authorityEntityIds": ["agent.identity", "agent.grant", "agent.scope", "agent.mcp_tool"],
      "adapterId": "adapter.gateway.agent_api",
      "summary": "Owns MCP/tool grants, idempotency, audit, and adapter execution envelope."
    }
  ],
  "adapterStatuses": [
    "implemented",
    "planned",
    "future",
    "forbidden"
  ],
  "actions": [
    {
      "id": "assistant.action.resolve",
      "app": "gateway",
      "domain": "assistant",
      "intentAliases": ["resolve action", "route command", "understand command"],
      "entityIds": ["assistant.action_request", "assistant.action", "assistant.action_registry"],
      "capabilityIds": ["assistant.resolve_context"],
      "riskLevel": "read",
      "confirmationMode": "none",
      "selfActionPolicy": "allowed",
      "adapterId": "adapter.gateway.agent_api",
      "adapterStatus": "planned",
      "summary": "Resolve natural-language user request into a known registered action before policy/execution."
    },
    {
      "id": "hub.user.read_admin_summary",
      "app": "hub",
      "domain": "users",
      "intentAliases": ["show users", "show user access", "summarize users", "покажи пользователей", "покажи доступы пользователя"],
      "entityIds": ["hub.user", "hub.membership", "hub.application_access"],
      "capabilityIds": ["assistant.view_admin_summary"],
      "riskLevel": "read",
      "confirmationMode": "none",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["launcher_admin_scope.any"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "summary": "Read scoped admin summary for HUB users, memberships, app access, and assistant access role."
    },
    {
      "id": "hub.invite.list_pending",
      "app": "hub",
      "domain": "invites",
      "intentAliases": ["pending invites", "show pending invites", "покажи инвайты", "покажи ожидающие инвайты"],
      "entityIds": ["hub.invite", "hub.client_context", "hub.public_pool_context"],
      "capabilityIds": ["assistant.view_access_requests"],
      "riskLevel": "read",
      "confirmationMode": "none",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["launcher_admin_scope.any"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "summary": "List pending invites visible inside current Launcher admin scope."
    },
    {
      "id": "hub.access_request.list_pending",
      "app": "hub",
      "domain": "access_requests",
      "intentAliases": ["pending access requests", "new access requests", "show access requests", "show launcher requests", "покажи заявки", "покажи новые заявки", "есть ли новые заявки", "заявки доступа", "заявки в лаунчере"],
      "entityIds": ["hub.access_request", "hub.client_context", "hub.public_pool_context"],
      "capabilityIds": ["assistant.view_access_requests"],
      "riskLevel": "read",
      "confirmationMode": "none",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["launcher_admin_scope.any"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "summary": "List pending public access requests visible inside current Launcher admin scope."
    },
    {
      "id": "hub.user.block",
      "app": "hub",
      "domain": "users",
      "intentAliases": ["block user", "disable user", "заблокируй пользователя", "отключи аккаунт"],
      "entityIds": ["hub.user"],
      "capabilityIds": ["assistant.manage_users"],
      "riskLevel": "privileged",
      "confirmationMode": "explicit",
      "selfActionPolicy": "no_self_lockout",
      "requiredScopes": ["launcher_admin_scope.can_manage_user"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["PATCH /api/admin/users/:userId/profile"],
      "sourcePatch": { "globalStatus": "blocked" },
      "hardDenyIds": ["assistant.action.deny.self_lockout"],
      "summary": "Block HUB user account through existing Launcher admin guards."
    },
    {
      "id": "hub.user.unblock",
      "app": "hub",
      "domain": "users",
      "intentAliases": ["unblock user", "activate user", "разблокируй пользователя", "включи аккаунт"],
      "entityIds": ["hub.user"],
      "capabilityIds": ["assistant.manage_users"],
      "riskLevel": "privileged",
      "confirmationMode": "explicit",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["launcher_admin_scope.can_manage_user"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["PATCH /api/admin/users/:userId/profile"],
      "sourcePatch": { "globalStatus": "active" },
      "summary": "Unblock HUB user account through existing Launcher admin guards."
    },
    {
      "id": "hub.user.delete",
      "app": "hub",
      "domain": "users",
      "intentAliases": ["delete user", "remove user", "удали пользователя", "сотри пользователя"],
      "entityIds": ["hub.user"],
      "capabilityIds": ["assistant.manage_users"],
      "riskLevel": "destructive",
      "confirmationMode": "forbidden",
      "selfActionPolicy": "blocked",
      "adapterId": "adapter.forbidden",
      "adapterStatus": "forbidden",
      "hardDenyIds": ["assistant.action.deny.delete_user", "assistant.action.deny.hard_delete_records"],
      "safeAlternativeActionIds": ["hub.user.block", "hub.membership.disable"],
      "refusal": "Я не удаляю пользователей. Могу заблокировать аккаунт или отключить доступ в конкретном контуре.",
      "summary": "Explicit forbidden action card for user deletion requests."
    },
    {
      "id": "hub.membership.change_role",
      "app": "hub",
      "domain": "memberships",
      "intentAliases": ["change hub role", "change client role", "измени роль в хабе", "измени роль в контуре"],
      "entityIds": ["hub.membership", "hub.role"],
      "capabilityIds": ["assistant.manage_client_memberships"],
      "riskLevel": "privileged",
      "confirmationMode": "explicit",
      "selfActionPolicy": "no_self_lockout",
      "requiredScopes": ["launcher_admin_scope.can_manage_membership"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
      "hardDenyIds": ["assistant.action.deny.self_lockout"],
      "summary": "Change HUB/Launcher client membership role through existing Launcher admin guards."
    },
    {
      "id": "hub.membership.disable",
      "app": "hub",
      "domain": "memberships",
      "intentAliases": ["disable context access", "disable membership", "отключи доступ в контуре"],
      "entityIds": ["hub.membership"],
      "capabilityIds": ["assistant.manage_client_memberships"],
      "riskLevel": "privileged",
      "confirmationMode": "explicit",
      "selfActionPolicy": "no_self_lockout",
      "requiredScopes": ["launcher_admin_scope.can_manage_membership"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
      "sourcePatch": { "status": "disabled" },
      "hardDenyIds": ["assistant.action.deny.self_lockout"],
      "summary": "Disable a user's membership in a HUB client/public context."
    },
    {
      "id": "hub.assistant_access.change_role",
      "app": "hub",
      "domain": "assistant_access",
      "intentAliases": ["change assistant role", "block assistant", "enable assistant admin", "измени роль ассистента", "отключи ассистента"],
      "entityIds": ["assistant.core_access", "assistant.access_role", "hub.membership"],
      "capabilityIds": ["assistant.manage_assistant_access"],
      "riskLevel": "privileged",
      "confirmationMode": "explicit",
      "selfActionPolicy": "no_self_lockout",
      "requiredScopes": ["launcher_admin_scope.can_manage_membership"],
      "adapterId": "adapter.hub.launcher_admin_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
      "allowedValues": ["blocked", "member", "admin"],
      "hardDenyIds": ["assistant.action.deny.self_lockout"],
      "summary": "Change NDC Core Assistant access role stored on HUB membership."
    },
    {
      "id": "ops.card.list_recent",
      "app": "ops",
      "domain": "cards",
      "intentAliases": ["latest ops task", "last ops task", "recent ops cards", "show ops tasks", "show ops cards", "последняя задача в опсе", "последнюю задачу в опсе", "последние задачи в опсе", "задачи в опсе", "карточки в опсе", "покажи задачи ops", "покажи карточки ops"],
      "entityIds": ["ops.card", "ops.project", "ops.workspace"],
      "capabilityIds": ["assistant.read_own_context"],
      "riskLevel": "read",
      "confirmationMode": "none",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["ops.project.can_read_card"],
      "adapterId": "adapter.ops.product_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["GET /api/v1/tools/issues"],
      "summary": "Read recent OPS Product cards in the current user-authorized project through the local Ops Gateway."
    },
    {
      "id": "ops.card.create",
      "app": "ops",
      "domain": "cards",
      "intentAliases": ["create ops card", "create ops task", "create card in ops", "create task in ops", "create card", "create task", "создай карточку в опсе", "создай задачу в опсе", "заведи карточку в опсе", "заведи задачу в опсе", "создай карточку", "создай задачу"],
      "entityIds": ["ops.card", "ops.project", "ops.workspace"],
      "capabilityIds": ["assistant.create_own_ops_card"],
      "riskLevel": "write",
      "confirmationMode": "explicit",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["ops.project.can_create_card"],
      "adapterId": "adapter.ops.product_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["POST /api/v1/tools/issues"],
      "summary": "Create OPS Product card through OPS-owned Gateway adapter."
    },
    {
      "id": "ops.card.add_comment",
      "app": "ops",
      "domain": "cards",
      "intentAliases": ["add ops comment", "comment ops card", "comment ops task", "write in ops card", "write in ops task", "добавь комментарий в опсе", "добавь комментарий в задачу", "напиши в задаче опса", "напиши в карточке опса", "напиши в этой задаче", "запиши в карточку опса", "оставь комментарий в задаче"],
      "entityIds": ["ops.card", "ops.card_comment", "ops.project", "ops.workspace"],
      "capabilityIds": ["assistant.create_own_ops_card"],
      "riskLevel": "write",
      "confirmationMode": "explicit",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["ops.card.can_comment"],
      "adapterId": "adapter.ops.product_api",
      "adapterStatus": "implemented",
      "sourceEndpoints": ["POST /api/v1/tools/issues/:issueId/comments"],
      "summary": "Append comment to OPS Product card through OPS-owned Gateway adapter."
    },
    {
      "id": "ops.card.update_status",
      "app": "ops",
      "domain": "cards",
      "intentAliases": ["update card status", "close card", "archive card safely", "измени статус карточки", "закрой карточку"],
      "entityIds": ["ops.card", "ops.project", "ops.workspace"],
      "capabilityIds": ["assistant.create_own_ops_card"],
      "riskLevel": "write",
      "confirmationMode": "explicit",
      "selfActionPolicy": "allowed",
      "requiredScopes": ["ops.card.can_update_status"],
      "adapterId": "adapter.ops.product_api",
      "adapterStatus": "planned",
      "summary": "Update OPS Product card status through OPS-owned adapter. This is the safe alternative to destructive card deletion."
    },
    {
      "id": "ops.project.grant_member",
      "app": "ops",
      "domain": "project_members",
      "intentAliases": ["grant ops project", "add ops project member", "добавь в проект опса"],
      "entityIds": ["ops.project_member", "ops.project", "ops.workspace_member"],
      "capabilityIds": ["assistant.manage_ops_project_membership"],
      "riskLevel": "privileged",
      "confirmationMode": "explicit",
      "selfActionPolicy": "app_owned",
      "requiredScopes": ["ops.project.can_manage_members"],
      "adapterId": "adapter.ops.product_api",
      "adapterStatus": "future",
      "hardDenyIds": ["assistant.action.deny.cross_app_role_ownership"],
      "summary": "Grant OPS Product project access through OPS-owned role adapter, not HUB direct mutation."
    },
    {
      "id": "engine.workflow.share",
      "app": "engine",
      "domain": "workflow_acl",
      "intentAliases": ["share workflow", "grant engine workflow", "пошарь workflow", "дай доступ к workflow"],
      "entityIds": ["engine.workflow_share", "engine.workflow_acl", "engine.workflow_l1"],
      "capabilityIds": ["assistant.request_own_engine_workflow_action"],
      "riskLevel": "privileged",
      "confirmationMode": "explicit",
      "selfActionPolicy": "app_owned",
      "requiredScopes": ["engine.workflow.can_manage_acl"],
      "adapterId": "adapter.engine.workflow_api",
      "adapterStatus": "future",
      "hardDenyIds": ["assistant.action.deny.cross_app_role_ownership"],
      "summary": "Share ENGINE workflow through Engine-owned ACL adapter."
    },
    {
      "id": "gateway.grant.select_tool_scope",
      "app": "gateway",
      "domain": "agent_grants",
      "intentAliases": ["select gateway grant", "select mcp tool", "выбери mcp tool"],
      "entityIds": ["agent.grant", "agent.scope", "agent.mcp_tool", "agent.idempotency_key"],
      "capabilityIds": ["assistant.resolve_context"],
      "riskLevel": "read",
      "confirmationMode": "none",
      "selfActionPolicy": "allowed",
      "adapterId": "adapter.gateway.agent_api",
      "adapterStatus": "planned",
      "summary": "Select candidate Gateway grant/tool/scope before execution. Does not create grants."
    }
  ]
}
