feat(ontology): add core service catalog
This commit is contained in:
Codex
@@ -0,0 +1,36 @@
|
||||
{
|
||||
"version": "0.4-pre",
|
||||
"updatedAt": "2026-06-19",
|
||||
"aliases": [
|
||||
{ "alias": "Plane Issue", "canonicalId": "ops.card" },
|
||||
{ "alias": "issue", "canonicalId": "ops.card" },
|
||||
{ "alias": "task", "canonicalId": "ops.card" },
|
||||
{ "alias": "ticket", "canonicalId": "ops.card" },
|
||||
{ "alias": "work item", "canonicalId": "ops.card" },
|
||||
{ "alias": "карточка", "canonicalId": "ops.card" },
|
||||
{ "alias": "задача", "canonicalId": "ops.card" },
|
||||
{ "alias": "Authentik user", "canonicalId": "ndcauth.identity" },
|
||||
{ "alias": "OIDC subject", "canonicalId": "ndcauth.identity" },
|
||||
{ "alias": "JWT subject", "canonicalId": "ndcauth.identity" },
|
||||
{ "alias": "Launcher service", "canonicalId": "hub.application" },
|
||||
{ "alias": "app", "canonicalId": "hub.application" },
|
||||
{ "alias": "application tile", "canonicalId": "hub.application_card" },
|
||||
{ "alias": "app card", "canonicalId": "hub.application_card" },
|
||||
{ "alias": "n8n workflow id", "canonicalId": "engine.workflow_l2_runtime_id" },
|
||||
{ "alias": "runtime workflow id", "canonicalId": "engine.workflow_l2_runtime_id" },
|
||||
{ "alias": "n8n execution", "canonicalId": "engine.l2_execution" },
|
||||
{ "alias": "Engine-side OPS", "canonicalId": "engine.tech_debt.ops_layer" },
|
||||
{ "alias": "Agent Monitor OPS", "canonicalId": "engine.tech_debt.ops_layer" },
|
||||
{ "alias": "Tender Agent Monitor UI", "canonicalId": "engine.tech_debt.tender_domain_ui" },
|
||||
{ "alias": "NOTG controller layer", "canonicalId": "future.interface_layer" },
|
||||
{ "alias": "interface layer", "canonicalId": "future.interface_layer" },
|
||||
{ "alias": "NDC Core Assistant", "canonicalId": "assistant.core_access" },
|
||||
{ "alias": "Core Assistant", "canonicalId": "assistant.core_access" },
|
||||
{ "alias": "assistant access", "canonicalId": "assistant.core_access" },
|
||||
{ "alias": "assistant role", "canonicalId": "assistant.access_role" },
|
||||
{ "alias": "assistant admin", "canonicalId": "assistant.access_role" },
|
||||
{ "alias": "assistant action", "canonicalId": "assistant.action" },
|
||||
{ "alias": "action card", "canonicalId": "assistant.action" },
|
||||
{ "alias": "action registry", "canonicalId": "assistant.action_registry" }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,241 @@
|
||||
{
|
||||
"version": "0.1.0",
|
||||
"updatedAt": "2026-06-19",
|
||||
"status": "draft-source-evidenced",
|
||||
"summary": "NDC Core Assistant access overlay. It controls assistant visibility and assistant-mediated capabilities, but never bypasses Launcher/HUB admin guards or OPS Gateway enforcement.",
|
||||
"roleVocabulary": [
|
||||
{
|
||||
"id": "assistant_blocked",
|
||||
"name": "Blocked",
|
||||
"summary": "No assistant icon, no assistant surface, no assistant capabilities."
|
||||
},
|
||||
{
|
||||
"id": "assistant_member",
|
||||
"name": "Member",
|
||||
"summary": "Default personal assistant access for active users inside their allowed contexts."
|
||||
},
|
||||
{
|
||||
"id": "assistant_admin",
|
||||
"name": "Admin",
|
||||
"summary": "Assistant-mediated administration, limited by existing Launcher root/client admin scope."
|
||||
}
|
||||
],
|
||||
"roleAliases": [
|
||||
{ "alias": "blocked", "roleId": "assistant_blocked" },
|
||||
{ "alias": "off", "roleId": "assistant_blocked" },
|
||||
{ "alias": "disabled", "roleId": "assistant_blocked" },
|
||||
{ "alias": "member", "roleId": "assistant_member" },
|
||||
{ "alias": "participant", "roleId": "assistant_member" },
|
||||
{ "alias": "admin", "roleId": "assistant_admin" },
|
||||
{ "alias": "administrator", "roleId": "assistant_admin" }
|
||||
],
|
||||
"defaultResolution": {
|
||||
"activeUserDefaultRole": "assistant_member",
|
||||
"blockedUserEffectiveRole": "assistant_blocked",
|
||||
"disabledMembershipRemovesContextAdminScope": true,
|
||||
"superAdminDefaultRole": "assistant_admin",
|
||||
"assistantRoleDoesNotGrantLauncherAdmin": true
|
||||
},
|
||||
"sourceAuthorities": [
|
||||
{
|
||||
"id": "hub.launcher_global_role",
|
||||
"entityIds": ["hub.user", "hub.role"],
|
||||
"source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/src/entities/user/types.ts",
|
||||
"summary": "LauncherGlobalRole includes root_admin, support_admin, client_owner, client_admin, member."
|
||||
},
|
||||
{
|
||||
"id": "hub.client_membership_role",
|
||||
"entityIds": ["hub.membership", "hub.role"],
|
||||
"source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/src/entities/user/types.ts",
|
||||
"summary": "ClientMembershipRole includes client_owner, client_admin, member; membership status includes active/disabled."
|
||||
},
|
||||
{
|
||||
"id": "hub.resolve_admin_scope",
|
||||
"entityIds": ["assistant.admin_scope", "hub.membership", "hub.role"],
|
||||
"source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/server/dev-server.mjs#resolveAdminScope",
|
||||
"summary": "Root scope comes from nodedc:superadmin/nodedc:launcher:admin groups. Client scope comes from active client_owner/client_admin membership."
|
||||
},
|
||||
{
|
||||
"id": "hub.admin_guards",
|
||||
"entityIds": ["assistant.admin_scope", "hub.user", "hub.client_context"],
|
||||
"source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/server/dev-server.mjs#assertAdminCanManageClient/assertAdminCanManageUser/assertAdminCanManageAccessForUser",
|
||||
"summary": "Launcher backend guards constrain which client, user, memberships, grants, and requests an admin can manage."
|
||||
},
|
||||
{
|
||||
"id": "hub.admin_ui_access_matrix",
|
||||
"entityIds": ["hub.application_access", "ops.workspace_member", "ops.project_member"],
|
||||
"source": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher/src/widgets/admin-overlay/AdminOverlay.tsx",
|
||||
"summary": "Admin UI already exposes MAIN status, MAIN role, service access, Operational Core workspace/project roles, invites, and access requests."
|
||||
}
|
||||
],
|
||||
"capabilities": [
|
||||
{ "id": "assistant.visible", "entityId": "assistant.capability", "level": "surface", "summary": "Assistant icon/surface can be shown." },
|
||||
{ "id": "assistant.use", "entityId": "assistant.capability", "level": "member", "summary": "User can talk to personal assistant in allowed contexts." },
|
||||
{ "id": "assistant.resolve_context", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can use ontology to resolve HUB/OPS Product/ENGINE context." },
|
||||
{ "id": "assistant.read_own_context", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can read current user's allowed context summaries through permitted tools." },
|
||||
{ "id": "assistant.create_own_ops_card", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can help create/update OPS Product cards in a user-authorized project." },
|
||||
{ "id": "assistant.request_own_engine_workflow_action", "entityId": "assistant.capability", "level": "member", "summary": "Assistant can prepare/request actions for Engine workflow context available to the user." },
|
||||
{ "id": "assistant.view_admin_summary", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can summarize admin-visible users, memberships, invites, requests, and access matrix state." },
|
||||
{ "id": "assistant.manage_users", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request user profile/status updates through Launcher admin guards." },
|
||||
{ "id": "assistant.manage_client_memberships", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request client membership role/status changes through Launcher admin guards." },
|
||||
{ "id": "assistant.view_pending_invites", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can list pending invites visible in admin scope." },
|
||||
{ "id": "assistant.manage_invites", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can create/update/revoke invites inside admin scope." },
|
||||
{ "id": "assistant.view_access_requests", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can list pending access/workflow/tasker requests visible in admin scope." },
|
||||
{ "id": "assistant.manage_ops_workspace_membership", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request Operational Core workspace membership changes through Launcher admin guards." },
|
||||
{ "id": "assistant.manage_ops_project_membership", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request Operational Core project membership changes through Launcher admin guards." },
|
||||
{ "id": "assistant.manage_engine_workflow_requests", "entityId": "assistant.capability", "level": "root", "summary": "Assistant can approve/reject Engine workflow access requests only when Launcher route remains root-only." },
|
||||
{ "id": "assistant.manage_service_catalog", "entityId": "assistant.capability", "level": "root", "summary": "Assistant can request service catalog/settings mutations only for root scope." },
|
||||
{ "id": "assistant.manage_assistant_access", "entityId": "assistant.capability", "level": "admin", "summary": "Assistant can request changes to assistant role assignments inside admin scope after this feature is implemented in HUB." }
|
||||
],
|
||||
"roleMatrix": [
|
||||
{
|
||||
"roleId": "assistant_blocked",
|
||||
"visible": false,
|
||||
"canUse": false,
|
||||
"allowedCapabilities": [],
|
||||
"deniedCapabilities": ["*"],
|
||||
"summary": "Hard off."
|
||||
},
|
||||
{
|
||||
"roleId": "assistant_member",
|
||||
"visible": true,
|
||||
"canUse": true,
|
||||
"allowedCapabilities": [
|
||||
"assistant.visible",
|
||||
"assistant.use",
|
||||
"assistant.resolve_context",
|
||||
"assistant.read_own_context",
|
||||
"assistant.create_own_ops_card",
|
||||
"assistant.request_own_engine_workflow_action"
|
||||
],
|
||||
"deniedCapabilities": [
|
||||
"assistant.view_admin_summary",
|
||||
"assistant.manage_users",
|
||||
"assistant.manage_client_memberships",
|
||||
"assistant.view_pending_invites",
|
||||
"assistant.manage_invites",
|
||||
"assistant.view_access_requests",
|
||||
"assistant.manage_ops_workspace_membership",
|
||||
"assistant.manage_ops_project_membership",
|
||||
"assistant.manage_engine_workflow_requests",
|
||||
"assistant.manage_service_catalog",
|
||||
"assistant.manage_assistant_access"
|
||||
],
|
||||
"summary": "Current default personal assistant behavior."
|
||||
},
|
||||
{
|
||||
"roleId": "assistant_admin",
|
||||
"visible": true,
|
||||
"canUse": true,
|
||||
"allowedCapabilities": [
|
||||
"assistant.visible",
|
||||
"assistant.use",
|
||||
"assistant.resolve_context",
|
||||
"assistant.read_own_context",
|
||||
"assistant.create_own_ops_card",
|
||||
"assistant.request_own_engine_workflow_action",
|
||||
"assistant.view_admin_summary",
|
||||
"assistant.manage_users",
|
||||
"assistant.manage_client_memberships",
|
||||
"assistant.view_pending_invites",
|
||||
"assistant.manage_invites",
|
||||
"assistant.view_access_requests",
|
||||
"assistant.manage_ops_workspace_membership",
|
||||
"assistant.manage_ops_project_membership",
|
||||
"assistant.manage_assistant_access"
|
||||
],
|
||||
"conditionalCapabilities": [
|
||||
{
|
||||
"capabilityId": "assistant.manage_engine_workflow_requests",
|
||||
"requires": "launcher_admin_scope.root"
|
||||
},
|
||||
{
|
||||
"capabilityId": "assistant.manage_service_catalog",
|
||||
"requires": "launcher_admin_scope.root"
|
||||
}
|
||||
],
|
||||
"deniedWhenNoAdminScope": [
|
||||
"assistant.view_admin_summary",
|
||||
"assistant.manage_users",
|
||||
"assistant.manage_client_memberships",
|
||||
"assistant.view_pending_invites",
|
||||
"assistant.manage_invites",
|
||||
"assistant.view_access_requests",
|
||||
"assistant.manage_ops_workspace_membership",
|
||||
"assistant.manage_ops_project_membership",
|
||||
"assistant.manage_engine_workflow_requests",
|
||||
"assistant.manage_service_catalog",
|
||||
"assistant.manage_assistant_access"
|
||||
],
|
||||
"summary": "Assistant-admin commands are enabled only when existing Launcher admin scope is present."
|
||||
}
|
||||
],
|
||||
"operations": [
|
||||
{
|
||||
"id": "assistant.op.change_user_status",
|
||||
"capabilityId": "assistant.manage_users",
|
||||
"sourceEndpoints": ["PATCH /api/admin/users/:userId/profile"],
|
||||
"requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageUser"],
|
||||
"summary": "Block/unblock/invite-state management for a user visible in admin scope."
|
||||
},
|
||||
{
|
||||
"id": "assistant.op.change_client_membership",
|
||||
"capabilityId": "assistant.manage_client_memberships",
|
||||
"sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
|
||||
"requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageMembership"],
|
||||
"summary": "Change client role/status for a visible membership."
|
||||
},
|
||||
{
|
||||
"id": "assistant.op.list_pending_invites",
|
||||
"capabilityId": "assistant.view_pending_invites",
|
||||
"sourceEndpoints": ["GET /api/admin/control-plane"],
|
||||
"requiredGuards": ["requireLauncherAdmin", "scopeControlPlaneData"],
|
||||
"summary": "List pending invites visible after Launcher data scoping."
|
||||
},
|
||||
{
|
||||
"id": "assistant.op.manage_ops_workspace_membership",
|
||||
"capabilityId": "assistant.manage_ops_workspace_membership",
|
||||
"sourceEndpoints": ["POST /api/admin/task-manager/workspace-memberships/ensure"],
|
||||
"requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageClient", "assertAdminCanManageAccessForUser"],
|
||||
"hardDenies": ["assistant.deny.task_manager_admin_role_locked"],
|
||||
"summary": "Ensure/revoke Operational Core workspace access without granting Task Manager admin role."
|
||||
},
|
||||
{
|
||||
"id": "assistant.op.manage_ops_project_membership",
|
||||
"capabilityId": "assistant.manage_ops_project_membership",
|
||||
"sourceEndpoints": ["POST /api/admin/task-manager/project-memberships/ensure"],
|
||||
"requiredGuards": ["requireLauncherAdmin", "assertAdminCanManageClient", "assertAdminCanManageAccessForUser"],
|
||||
"hardDenies": ["assistant.deny.task_manager_admin_role_locked"],
|
||||
"summary": "Ensure/revoke Operational Core project access without granting Task Manager admin role."
|
||||
},
|
||||
{
|
||||
"id": "assistant.op.manage_engine_workflow_request",
|
||||
"capabilityId": "assistant.manage_engine_workflow_requests",
|
||||
"sourceEndpoints": ["PATCH /api/admin/engine-workflow-access-requests/:requestId/approve", "PATCH /api/admin/engine-workflow-access-requests/:requestId/reject"],
|
||||
"requiredGuards": ["requireRootLauncherAdmin"],
|
||||
"summary": "Root-only request management stays root-only."
|
||||
}
|
||||
],
|
||||
"hardDenies": [
|
||||
{
|
||||
"id": "assistant.deny.task_manager_admin_role_locked",
|
||||
"entityIds": ["ops.workspace_member", "ops.project_member"],
|
||||
"summary": "Launcher source currently forbids requestedRole === admin for Task Manager workspace/project membership mutations."
|
||||
},
|
||||
{
|
||||
"id": "assistant.deny.protected_user_root_locked",
|
||||
"entityIds": ["hub.user"],
|
||||
"summary": "Protected user_root cannot be managed by ordinary admins; source guards protect it."
|
||||
},
|
||||
{
|
||||
"id": "assistant.deny.no_scope_escalation",
|
||||
"entityIds": ["assistant.access_role", "assistant.admin_scope", "agent.grant"],
|
||||
"summary": "Assistant role cannot create Launcher admin scope or Gateway grants by itself."
|
||||
},
|
||||
{
|
||||
"id": "assistant.deny.root_only_stays_root_only",
|
||||
"entityIds": ["hub.client_context", "hub.application", "engine.workflow_access_request"],
|
||||
"summary": "Root-only backend endpoints remain root-only even when assistant role is assistant_admin."
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,317 @@
|
||||
{
|
||||
"version": "0.1.0",
|
||||
"updatedAt": "2026-06-19",
|
||||
"status": "draft-owner-confirmed",
|
||||
"summary": "Declarative assistant action registry. Actions route requests to app-owned adapters after ontology context resolution and policy checks.",
|
||||
"apps": [
|
||||
{
|
||||
"id": "hub",
|
||||
"name": "HUB / Launcher",
|
||||
"authorityEntityIds": ["hub.user", "hub.membership", "hub.invite", "hub.application_access"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"summary": "Owns platform entry access, clients, memberships, invites, service access matrix, and assistant access role assignments."
|
||||
},
|
||||
{
|
||||
"id": "ops",
|
||||
"name": "OPS Product",
|
||||
"authorityEntityIds": ["ops.workspace", "ops.project", "ops.card", "ops.workspace_member", "ops.project_member"],
|
||||
"adapterId": "adapter.ops.product_api",
|
||||
"summary": "Owns Operational Core workspace/project/card model and internal OPS roles."
|
||||
},
|
||||
{
|
||||
"id": "engine",
|
||||
"name": "ENGINE",
|
||||
"authorityEntityIds": ["engine.workflow_l1", "engine.workflow_acl", "engine.workflow_share"],
|
||||
"adapterId": "adapter.engine.workflow_api",
|
||||
"summary": "Owns workflow ACL, workflow sharing, and Engine runtime/workflow context."
|
||||
},
|
||||
{
|
||||
"id": "gateway",
|
||||
"name": "OPS Gateway",
|
||||
"authorityEntityIds": ["agent.identity", "agent.grant", "agent.scope", "agent.mcp_tool"],
|
||||
"adapterId": "adapter.gateway.agent_api",
|
||||
"summary": "Owns MCP/tool grants, idempotency, audit, and adapter execution envelope."
|
||||
}
|
||||
],
|
||||
"adapterStatuses": [
|
||||
"implemented",
|
||||
"planned",
|
||||
"future",
|
||||
"forbidden"
|
||||
],
|
||||
"actions": [
|
||||
{
|
||||
"id": "assistant.action.resolve",
|
||||
"app": "gateway",
|
||||
"domain": "assistant",
|
||||
"intentAliases": ["resolve action", "route command", "understand command"],
|
||||
"entityIds": ["assistant.action_request", "assistant.action", "assistant.action_registry"],
|
||||
"capabilityIds": ["assistant.resolve_context"],
|
||||
"riskLevel": "read",
|
||||
"confirmationMode": "none",
|
||||
"selfActionPolicy": "allowed",
|
||||
"adapterId": "adapter.gateway.agent_api",
|
||||
"adapterStatus": "planned",
|
||||
"summary": "Resolve natural-language user request into a known registered action before policy/execution."
|
||||
},
|
||||
{
|
||||
"id": "hub.user.read_admin_summary",
|
||||
"app": "hub",
|
||||
"domain": "users",
|
||||
"intentAliases": ["show users", "show user access", "summarize users", "покажи пользователей", "покажи доступы пользователя"],
|
||||
"entityIds": ["hub.user", "hub.membership", "hub.application_access"],
|
||||
"capabilityIds": ["assistant.view_admin_summary"],
|
||||
"riskLevel": "read",
|
||||
"confirmationMode": "none",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["launcher_admin_scope.any"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"summary": "Read scoped admin summary for HUB users, memberships, app access, and assistant access role."
|
||||
},
|
||||
{
|
||||
"id": "hub.invite.list_pending",
|
||||
"app": "hub",
|
||||
"domain": "invites",
|
||||
"intentAliases": ["pending invites", "show pending invites", "покажи инвайты", "покажи ожидающие инвайты"],
|
||||
"entityIds": ["hub.invite", "hub.client_context", "hub.public_pool_context"],
|
||||
"capabilityIds": ["assistant.view_access_requests"],
|
||||
"riskLevel": "read",
|
||||
"confirmationMode": "none",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["launcher_admin_scope.any"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"summary": "List pending invites visible inside current Launcher admin scope."
|
||||
},
|
||||
{
|
||||
"id": "hub.access_request.list_pending",
|
||||
"app": "hub",
|
||||
"domain": "access_requests",
|
||||
"intentAliases": ["pending access requests", "new access requests", "show access requests", "show launcher requests", "покажи заявки", "покажи новые заявки", "есть ли новые заявки", "заявки доступа", "заявки в лаунчере"],
|
||||
"entityIds": ["hub.access_request", "hub.client_context", "hub.public_pool_context"],
|
||||
"capabilityIds": ["assistant.view_access_requests"],
|
||||
"riskLevel": "read",
|
||||
"confirmationMode": "none",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["launcher_admin_scope.any"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"summary": "List pending public access requests visible inside current Launcher admin scope."
|
||||
},
|
||||
{
|
||||
"id": "hub.user.block",
|
||||
"app": "hub",
|
||||
"domain": "users",
|
||||
"intentAliases": ["block user", "disable user", "заблокируй пользователя", "отключи аккаунт"],
|
||||
"entityIds": ["hub.user"],
|
||||
"capabilityIds": ["assistant.manage_users"],
|
||||
"riskLevel": "privileged",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "no_self_lockout",
|
||||
"requiredScopes": ["launcher_admin_scope.can_manage_user"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["PATCH /api/admin/users/:userId/profile"],
|
||||
"sourcePatch": { "globalStatus": "blocked" },
|
||||
"hardDenyIds": ["assistant.action.deny.self_lockout"],
|
||||
"summary": "Block HUB user account through existing Launcher admin guards."
|
||||
},
|
||||
{
|
||||
"id": "hub.user.unblock",
|
||||
"app": "hub",
|
||||
"domain": "users",
|
||||
"intentAliases": ["unblock user", "activate user", "разблокируй пользователя", "включи аккаунт"],
|
||||
"entityIds": ["hub.user"],
|
||||
"capabilityIds": ["assistant.manage_users"],
|
||||
"riskLevel": "privileged",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["launcher_admin_scope.can_manage_user"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["PATCH /api/admin/users/:userId/profile"],
|
||||
"sourcePatch": { "globalStatus": "active" },
|
||||
"summary": "Unblock HUB user account through existing Launcher admin guards."
|
||||
},
|
||||
{
|
||||
"id": "hub.user.delete",
|
||||
"app": "hub",
|
||||
"domain": "users",
|
||||
"intentAliases": ["delete user", "remove user", "удали пользователя", "сотри пользователя"],
|
||||
"entityIds": ["hub.user"],
|
||||
"capabilityIds": ["assistant.manage_users"],
|
||||
"riskLevel": "destructive",
|
||||
"confirmationMode": "forbidden",
|
||||
"selfActionPolicy": "blocked",
|
||||
"adapterId": "adapter.forbidden",
|
||||
"adapterStatus": "forbidden",
|
||||
"hardDenyIds": ["assistant.action.deny.delete_user", "assistant.action.deny.hard_delete_records"],
|
||||
"safeAlternativeActionIds": ["hub.user.block", "hub.membership.disable"],
|
||||
"refusal": "Я не удаляю пользователей. Могу заблокировать аккаунт или отключить доступ в конкретном контуре.",
|
||||
"summary": "Explicit forbidden action card for user deletion requests."
|
||||
},
|
||||
{
|
||||
"id": "hub.membership.change_role",
|
||||
"app": "hub",
|
||||
"domain": "memberships",
|
||||
"intentAliases": ["change hub role", "change client role", "измени роль в хабе", "измени роль в контуре"],
|
||||
"entityIds": ["hub.membership", "hub.role"],
|
||||
"capabilityIds": ["assistant.manage_client_memberships"],
|
||||
"riskLevel": "privileged",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "no_self_lockout",
|
||||
"requiredScopes": ["launcher_admin_scope.can_manage_membership"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
|
||||
"hardDenyIds": ["assistant.action.deny.self_lockout"],
|
||||
"summary": "Change HUB/Launcher client membership role through existing Launcher admin guards."
|
||||
},
|
||||
{
|
||||
"id": "hub.membership.disable",
|
||||
"app": "hub",
|
||||
"domain": "memberships",
|
||||
"intentAliases": ["disable context access", "disable membership", "отключи доступ в контуре"],
|
||||
"entityIds": ["hub.membership"],
|
||||
"capabilityIds": ["assistant.manage_client_memberships"],
|
||||
"riskLevel": "privileged",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "no_self_lockout",
|
||||
"requiredScopes": ["launcher_admin_scope.can_manage_membership"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
|
||||
"sourcePatch": { "status": "disabled" },
|
||||
"hardDenyIds": ["assistant.action.deny.self_lockout"],
|
||||
"summary": "Disable a user's membership in a HUB client/public context."
|
||||
},
|
||||
{
|
||||
"id": "hub.assistant_access.change_role",
|
||||
"app": "hub",
|
||||
"domain": "assistant_access",
|
||||
"intentAliases": ["change assistant role", "block assistant", "enable assistant admin", "измени роль ассистента", "отключи ассистента"],
|
||||
"entityIds": ["assistant.core_access", "assistant.access_role", "hub.membership"],
|
||||
"capabilityIds": ["assistant.manage_assistant_access"],
|
||||
"riskLevel": "privileged",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "no_self_lockout",
|
||||
"requiredScopes": ["launcher_admin_scope.can_manage_membership"],
|
||||
"adapterId": "adapter.hub.launcher_admin_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["PATCH /api/admin/memberships/:membershipId"],
|
||||
"allowedValues": ["blocked", "member", "admin"],
|
||||
"hardDenyIds": ["assistant.action.deny.self_lockout"],
|
||||
"summary": "Change NDC Core Assistant access role stored on HUB membership."
|
||||
},
|
||||
{
|
||||
"id": "ops.card.list_recent",
|
||||
"app": "ops",
|
||||
"domain": "cards",
|
||||
"intentAliases": ["latest ops task", "last ops task", "recent ops cards", "show ops tasks", "show ops cards", "последняя задача в опсе", "последнюю задачу в опсе", "последние задачи в опсе", "задачи в опсе", "карточки в опсе", "покажи задачи ops", "покажи карточки ops"],
|
||||
"entityIds": ["ops.card", "ops.project", "ops.workspace"],
|
||||
"capabilityIds": ["assistant.read_own_context"],
|
||||
"riskLevel": "read",
|
||||
"confirmationMode": "none",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["ops.project.can_read_card"],
|
||||
"adapterId": "adapter.ops.product_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["GET /api/v1/tools/issues"],
|
||||
"summary": "Read recent OPS Product cards in the current user-authorized project through the local Ops Gateway."
|
||||
},
|
||||
{
|
||||
"id": "ops.card.create",
|
||||
"app": "ops",
|
||||
"domain": "cards",
|
||||
"intentAliases": ["create ops card", "create ops task", "create card in ops", "create task in ops", "create card", "create task", "создай карточку в опсе", "создай задачу в опсе", "заведи карточку в опсе", "заведи задачу в опсе", "создай карточку", "создай задачу"],
|
||||
"entityIds": ["ops.card", "ops.project", "ops.workspace"],
|
||||
"capabilityIds": ["assistant.create_own_ops_card"],
|
||||
"riskLevel": "write",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["ops.project.can_create_card"],
|
||||
"adapterId": "adapter.ops.product_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["POST /api/v1/tools/issues"],
|
||||
"summary": "Create OPS Product card through OPS-owned Gateway adapter."
|
||||
},
|
||||
{
|
||||
"id": "ops.card.add_comment",
|
||||
"app": "ops",
|
||||
"domain": "cards",
|
||||
"intentAliases": ["add ops comment", "comment ops card", "comment ops task", "write in ops card", "write in ops task", "добавь комментарий в опсе", "добавь комментарий в задачу", "напиши в задаче опса", "напиши в карточке опса", "напиши в этой задаче", "запиши в карточку опса", "оставь комментарий в задаче"],
|
||||
"entityIds": ["ops.card", "ops.card_comment", "ops.project", "ops.workspace"],
|
||||
"capabilityIds": ["assistant.create_own_ops_card"],
|
||||
"riskLevel": "write",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["ops.card.can_comment"],
|
||||
"adapterId": "adapter.ops.product_api",
|
||||
"adapterStatus": "implemented",
|
||||
"sourceEndpoints": ["POST /api/v1/tools/issues/:issueId/comments"],
|
||||
"summary": "Append comment to OPS Product card through OPS-owned Gateway adapter."
|
||||
},
|
||||
{
|
||||
"id": "ops.card.update_status",
|
||||
"app": "ops",
|
||||
"domain": "cards",
|
||||
"intentAliases": ["update card status", "close card", "archive card safely", "измени статус карточки", "закрой карточку"],
|
||||
"entityIds": ["ops.card", "ops.project", "ops.workspace"],
|
||||
"capabilityIds": ["assistant.create_own_ops_card"],
|
||||
"riskLevel": "write",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "allowed",
|
||||
"requiredScopes": ["ops.card.can_update_status"],
|
||||
"adapterId": "adapter.ops.product_api",
|
||||
"adapterStatus": "planned",
|
||||
"summary": "Update OPS Product card status through OPS-owned adapter. This is the safe alternative to destructive card deletion."
|
||||
},
|
||||
{
|
||||
"id": "ops.project.grant_member",
|
||||
"app": "ops",
|
||||
"domain": "project_members",
|
||||
"intentAliases": ["grant ops project", "add ops project member", "добавь в проект опса"],
|
||||
"entityIds": ["ops.project_member", "ops.project", "ops.workspace_member"],
|
||||
"capabilityIds": ["assistant.manage_ops_project_membership"],
|
||||
"riskLevel": "privileged",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "app_owned",
|
||||
"requiredScopes": ["ops.project.can_manage_members"],
|
||||
"adapterId": "adapter.ops.product_api",
|
||||
"adapterStatus": "future",
|
||||
"hardDenyIds": ["assistant.action.deny.cross_app_role_ownership"],
|
||||
"summary": "Grant OPS Product project access through OPS-owned role adapter, not HUB direct mutation."
|
||||
},
|
||||
{
|
||||
"id": "engine.workflow.share",
|
||||
"app": "engine",
|
||||
"domain": "workflow_acl",
|
||||
"intentAliases": ["share workflow", "grant engine workflow", "пошарь workflow", "дай доступ к workflow"],
|
||||
"entityIds": ["engine.workflow_share", "engine.workflow_acl", "engine.workflow_l1"],
|
||||
"capabilityIds": ["assistant.request_own_engine_workflow_action"],
|
||||
"riskLevel": "privileged",
|
||||
"confirmationMode": "explicit",
|
||||
"selfActionPolicy": "app_owned",
|
||||
"requiredScopes": ["engine.workflow.can_manage_acl"],
|
||||
"adapterId": "adapter.engine.workflow_api",
|
||||
"adapterStatus": "future",
|
||||
"hardDenyIds": ["assistant.action.deny.cross_app_role_ownership"],
|
||||
"summary": "Share ENGINE workflow through Engine-owned ACL adapter."
|
||||
},
|
||||
{
|
||||
"id": "gateway.grant.select_tool_scope",
|
||||
"app": "gateway",
|
||||
"domain": "agent_grants",
|
||||
"intentAliases": ["select gateway grant", "select mcp tool", "выбери mcp tool"],
|
||||
"entityIds": ["agent.grant", "agent.scope", "agent.mcp_tool", "agent.idempotency_key"],
|
||||
"capabilityIds": ["assistant.resolve_context"],
|
||||
"riskLevel": "read",
|
||||
"confirmationMode": "none",
|
||||
"selfActionPolicy": "allowed",
|
||||
"adapterId": "adapter.gateway.agent_api",
|
||||
"adapterStatus": "planned",
|
||||
"summary": "Select candidate Gateway grant/tool/scope before execution. Does not create grants."
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,135 @@
|
||||
{
|
||||
"version": "0.1.0",
|
||||
"updatedAt": "2026-06-19",
|
||||
"status": "draft-owner-confirmed",
|
||||
"summary": "Risk policy for assistant action routing. This policy is intentionally conservative: destructive actions are forbidden, privileged writes are scoped, and app-owned roles stay app-owned.",
|
||||
"riskLevels": [
|
||||
{
|
||||
"id": "read",
|
||||
"requiresConfirmation": false,
|
||||
"summary": "Read or summarize data already visible to the actor."
|
||||
},
|
||||
{
|
||||
"id": "write",
|
||||
"requiresConfirmation": true,
|
||||
"summary": "Create or update non-destructive state."
|
||||
},
|
||||
{
|
||||
"id": "privileged",
|
||||
"requiresConfirmation": true,
|
||||
"summary": "Change users, roles, memberships, access, grants, workflow ACLs, or other privileged state."
|
||||
},
|
||||
{
|
||||
"id": "destructive",
|
||||
"requiresConfirmation": true,
|
||||
"assistantAllowed": false,
|
||||
"summary": "Delete, hard-remove, archive critical objects, or destroy production state. Forbidden for assistant execution."
|
||||
},
|
||||
{
|
||||
"id": "root_only",
|
||||
"requiresConfirmation": true,
|
||||
"summary": "Root-only administrative action. Assistant may route only when source app also confirms root scope."
|
||||
},
|
||||
{
|
||||
"id": "future",
|
||||
"requiresConfirmation": false,
|
||||
"assistantAllowed": false,
|
||||
"summary": "Conceptual action not wired to an adapter yet."
|
||||
}
|
||||
],
|
||||
"confirmationModes": [
|
||||
{
|
||||
"id": "none",
|
||||
"summary": "No extra confirmation beyond ordinary chat request."
|
||||
},
|
||||
{
|
||||
"id": "explicit",
|
||||
"summary": "Assistant must show exact target, action, app, scope, and expected effect before execution."
|
||||
},
|
||||
{
|
||||
"id": "typed",
|
||||
"summary": "Reserved for very high-risk future flows. Requires typing a short confirmation phrase."
|
||||
},
|
||||
{
|
||||
"id": "forbidden",
|
||||
"summary": "Assistant refuses and should offer the nearest safe alternative."
|
||||
}
|
||||
],
|
||||
"selfActionPolicies": [
|
||||
{
|
||||
"id": "allowed",
|
||||
"summary": "Self-targeting is allowed."
|
||||
},
|
||||
{
|
||||
"id": "blocked",
|
||||
"summary": "Self-targeting is never allowed."
|
||||
},
|
||||
{
|
||||
"id": "no_self_lockout",
|
||||
"summary": "Self-targeting is allowed only when it cannot remove the actor's own last access/admin path."
|
||||
},
|
||||
{
|
||||
"id": "app_owned",
|
||||
"summary": "Self-targeting is delegated to the app adapter because the app owns the role model."
|
||||
}
|
||||
],
|
||||
"hardDenies": [
|
||||
{
|
||||
"id": "assistant.action.deny.delete_user",
|
||||
"summary": "Assistant must never delete a HUB/Launcher user. Offer block user or disable membership instead.",
|
||||
"safeAlternatives": ["hub.user.block", "hub.membership.disable"]
|
||||
},
|
||||
{
|
||||
"id": "assistant.action.deny.hard_delete_records",
|
||||
"summary": "Assistant must never hard-delete records, database rows, files, runtime data, storage, backups, or production state.",
|
||||
"safeAlternatives": ["hub.user.block", "hub.membership.disable", "ops.card.update_status"]
|
||||
},
|
||||
{
|
||||
"id": "assistant.action.deny.self_lockout",
|
||||
"summary": "Assistant must never let an actor remove their own last admin/access path.",
|
||||
"safeAlternatives": ["hub.invite.list_pending", "hub.user.read_admin_summary"]
|
||||
},
|
||||
{
|
||||
"id": "assistant.action.deny.cross_app_role_ownership",
|
||||
"summary": "HUB action cannot mutate internal ENGINE workflow ACL or OPS Product project roles unless routed to the app-owned adapter.",
|
||||
"safeAlternatives": ["engine.workflow.share", "ops.project.grant_member"]
|
||||
},
|
||||
{
|
||||
"id": "assistant.action.deny.prompt_only_execution",
|
||||
"summary": "Assistant must not execute actions from prompt text alone. It must resolve a registered action card and pass policy first.",
|
||||
"safeAlternatives": ["assistant.action.resolve"]
|
||||
}
|
||||
],
|
||||
"globalRules": [
|
||||
{
|
||||
"id": "assistant.rule.registered_action_required",
|
||||
"severity": "error",
|
||||
"summary": "Every executable request must resolve to an action in assistant-actions.json."
|
||||
},
|
||||
{
|
||||
"id": "assistant.rule.destructive_forbidden",
|
||||
"severity": "error",
|
||||
"summary": "Actions with riskLevel=destructive or confirmationMode=forbidden are refused by default."
|
||||
},
|
||||
{
|
||||
"id": "assistant.rule.privileged_requires_admin_role",
|
||||
"severity": "error",
|
||||
"summary": "Actions with riskLevel=privileged require assistant_admin plus app-owned admin scope."
|
||||
},
|
||||
{
|
||||
"id": "assistant.rule.app_owned_roles_stay_app_owned",
|
||||
"severity": "error",
|
||||
"summary": "HUB may route but must not directly mutate OPS Product or ENGINE internal role models."
|
||||
},
|
||||
{
|
||||
"id": "assistant.rule.write_requires_idempotency",
|
||||
"severity": "error",
|
||||
"summary": "Write actions executed through Gateway adapters require an idempotency key."
|
||||
},
|
||||
{
|
||||
"id": "assistant.rule.audit_every_write",
|
||||
"severity": "error",
|
||||
"summary": "Write and privileged actions must emit app audit or gateway audit events."
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,65 @@
|
||||
{
|
||||
"version": "0.1.0",
|
||||
"updatedAt": "2026-06-19",
|
||||
"contextStatuses": ["active", "planned", "deprecated"],
|
||||
"bindingStatuses": ["active", "planned", "blocked"],
|
||||
"contexts": [
|
||||
{
|
||||
"id": "context.ops.nodedc.ndc_platform",
|
||||
"surface": "ops",
|
||||
"entityId": "ops.project",
|
||||
"sourceSystem": "tasker",
|
||||
"label": "NDC PLATFORM",
|
||||
"status": "active",
|
||||
"refs": {
|
||||
"workspace_slug": "nodedc",
|
||||
"project_id": "86629a11-eaff-4ad2-9f89-e5245a344fcc"
|
||||
}
|
||||
},
|
||||
{
|
||||
"id": "context.ops.nodedc.ndc_platform.ontology_core_card",
|
||||
"surface": "ops",
|
||||
"entityId": "ops.card",
|
||||
"sourceSystem": "tasker",
|
||||
"label": "Антология / Ontology Core",
|
||||
"status": "active",
|
||||
"parentContextId": "context.ops.nodedc.ndc_platform",
|
||||
"refs": {
|
||||
"workspace_slug": "nodedc",
|
||||
"project_id": "86629a11-eaff-4ad2-9f89-e5245a344fcc",
|
||||
"issue_id": "1312519a-0eda-4ea0-9e34-2113c3724ecf",
|
||||
"sequence_id": "43"
|
||||
}
|
||||
}
|
||||
],
|
||||
"bindingTypes": [
|
||||
{
|
||||
"id": "binding_type.ops_card_to_engine_workflow",
|
||||
"relationId": "ontology.resolves_ops_card_to_engine_context",
|
||||
"fromEntityIds": ["ops.card", "ops.project"],
|
||||
"toEntityIds": ["engine.workflow_l1", "engine.node_l1", "engine.workflow_l2", "engine.workflow_l2_runtime_id"],
|
||||
"requiredFromRefs": ["workspace_slug", "project_id"],
|
||||
"requiredToRefs": ["workflow_id"],
|
||||
"summary": "Binds OPS project/card context to Engine L1/L2 workflow context."
|
||||
},
|
||||
{
|
||||
"id": "binding_type.engine_workflow_to_ops_project",
|
||||
"relationId": "ontology.resolves_engine_context_to_ops_project",
|
||||
"fromEntityIds": ["engine.workflow_l1", "engine.workflow_l2", "engine.node_l1"],
|
||||
"toEntityIds": ["ops.project", "ops.card"],
|
||||
"requiredFromRefs": ["workflow_id"],
|
||||
"requiredToRefs": ["workspace_slug", "project_id"],
|
||||
"summary": "Binds Engine workflow/node context to OPS project/card context."
|
||||
},
|
||||
{
|
||||
"id": "binding_type.assistant_context_to_gateway_grant",
|
||||
"relationId": "ontology.selects_gateway_grant_context",
|
||||
"fromEntityIds": ["assistant.bridge", "assistant.executor"],
|
||||
"toEntityIds": ["agent.grant", "agent.scope", "agent.mcp_tool"],
|
||||
"requiredFromRefs": ["surface"],
|
||||
"requiredToRefs": ["grant_id"],
|
||||
"summary": "Binds resolved assistant context to Gateway grant/tool preflight."
|
||||
}
|
||||
],
|
||||
"bindings": []
|
||||
}
|
||||
@@ -0,0 +1,128 @@
|
||||
{
|
||||
"version": "0.4-pre",
|
||||
"updatedAt": "2026-06-19",
|
||||
"statusVocabulary": [
|
||||
"source-confirmed",
|
||||
"source-evidenced",
|
||||
"owner-confirmed",
|
||||
"product-required",
|
||||
"future-concept",
|
||||
"tech-debt-noncanonical",
|
||||
"pending",
|
||||
"source-adjacent"
|
||||
],
|
||||
"entities": [
|
||||
{ "id": "hub.open_contour", "name": "HUB Open Contour", "surface": "hub", "status": ["source-evidenced", "owner-confirmed"], "authority": "HUB", "summary": "Public/open branch for simple users." },
|
||||
{ "id": "hub.public_pool_context", "name": "HUB Public Pool Context", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Source-backed public context." },
|
||||
{ "id": "hub.public_pool_client", "name": "HUB Public Pool Client", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Special source-backed Client, not ordinary company/client." },
|
||||
{ "id": "hub.client_context", "name": "HUB Client Context", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Managed closed contour for companies/clients." },
|
||||
{ "id": "hub.company_contour", "name": "HUB Company Contour", "surface": "hub", "status": ["source-evidenced"], "authority": "HUB", "summary": "Product wording over managed client context." },
|
||||
{ "id": "hub.user", "name": "HUB User", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB/NDCAuth", "summary": "Canonical launcher user." },
|
||||
{ "id": "hub.public_user", "name": "HUB Public User Classification", "surface": "hub", "status": ["source-evidenced"], "authority": "HUB", "summary": "Classification of hub.user by public-pool context." },
|
||||
{ "id": "hub.client_user", "name": "HUB Client User Classification", "surface": "hub", "status": ["source-evidenced"], "authority": "HUB", "summary": "Classification of hub.user by client/company membership." },
|
||||
{ "id": "hub.membership", "name": "HUB Membership", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "User-to-context relation." },
|
||||
{ "id": "hub.public_membership", "name": "HUB Public Membership", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Membership in public pool context." },
|
||||
{ "id": "hub.access_request", "name": "HUB Access Request", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Base access request entity." },
|
||||
{ "id": "hub.public_access_request", "name": "HUB Public Access Request", "surface": "hub", "status": ["source-evidenced"], "authority": "HUB", "summary": "Public/open-contour access request subtype." },
|
||||
{ "id": "hub.client_access_request", "name": "HUB Client Access Request", "surface": "hub", "status": ["source-evidenced"], "authority": "HUB", "summary": "Company/client-context access request subtype." },
|
||||
{ "id": "hub.invite", "name": "HUB Invite", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Invitation into a context." },
|
||||
{ "id": "hub.group", "name": "HUB Group", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Client-local group." },
|
||||
{ "id": "hub.role", "name": "HUB Role", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Role vocabulary for user and membership decisions." },
|
||||
{ "id": "hub.permission", "name": "HUB Permission", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Derived permission capability." },
|
||||
{ "id": "hub.application", "name": "HUB Application", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Product application/service registered in launcher." },
|
||||
{ "id": "hub.application_access", "name": "HUB Application Access", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Effective app access result." },
|
||||
{ "id": "hub.app_grant", "name": "HUB App Grant", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "Access authority input." },
|
||||
{ "id": "hub.app_exception", "name": "HUB App Exception", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB", "summary": "User-specific allow/deny override." },
|
||||
{ "id": "hub.application_card", "name": "HUB Application Card", "surface": "hub", "status": ["source-confirmed"], "authority": "HUB UI", "summary": "Presentation over application/access state, not authority." },
|
||||
|
||||
{ "id": "ndcauth.identity", "name": "NDCAuth Identity", "surface": "ndcauth", "status": ["source-confirmed"], "authority": "NDCAuth/HUB", "summary": "Canonical auth identity." },
|
||||
{ "id": "ndcauth.session", "name": "NDCAuth Session", "surface": "ndcauth", "status": ["source-confirmed"], "authority": "NDCAuth/HUB", "summary": "Runtime authenticated/unauthenticated session." },
|
||||
|
||||
{ "id": "ops.workspace", "name": "OPS Workspace", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Workspace/root collaboration context." },
|
||||
{ "id": "ops.workspace_member", "name": "OPS Workspace Member", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "User membership in workspace." },
|
||||
{ "id": "ops.project", "name": "OPS Project", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Project inside workspace." },
|
||||
{ "id": "ops.project_member", "name": "OPS Project Member", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "User membership in project." },
|
||||
{ "id": "ops.card", "name": "OPS Card", "surface": "ops", "status": ["source-confirmed", "owner-confirmed"], "authority": "OPS Product", "summary": "Canonical work object." },
|
||||
{ "id": "ops.card_status", "name": "OPS Card Status", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "State/status of a card." },
|
||||
{ "id": "ops.card_priority", "name": "OPS Card Priority", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Card priority attribute." },
|
||||
{ "id": "ops.card_assignment", "name": "OPS Card Assignment", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Relation between card and assignee." },
|
||||
{ "id": "ops.assignee", "name": "OPS Assignee", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Assigned user/member." },
|
||||
{ "id": "ops.responsible", "name": "OPS Responsible", "surface": "ops", "status": ["product-required", "source-adjacent"], "authority": "OPS Product", "summary": "Accountability role, not automatically assignee." },
|
||||
{ "id": "ops.card_type", "name": "OPS Card Type", "surface": "ops", "status": ["source-evidenced", "pending"], "authority": "OPS Product", "summary": "Type/subtype of card." },
|
||||
{ "id": "ops.card_relation", "name": "OPS Card Relation", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Dependency/link between cards." },
|
||||
{ "id": "ops.external_ref", "name": "OPS External Reference", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Link to external/source object." },
|
||||
{ "id": "ops.card_label", "name": "OPS Card Label", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Label/tag classification." },
|
||||
{ "id": "ops.card_comment", "name": "OPS Card Comment", "surface": "ops", "status": ["source-confirmed"], "authority": "OPS Product", "summary": "Discussion/comment on a card." },
|
||||
{ "id": "ops.card_activity", "name": "OPS Card Activity", "surface": "ops", "status": ["source-evidenced"], "authority": "OPS Product", "summary": "Change/activity history." },
|
||||
{ "id": "ops.card_artifact_link", "name": "OPS Card Artifact Link", "surface": "ops", "status": ["source-evidenced"], "authority": "OPS Product", "summary": "Relation/link to output artifact." },
|
||||
{ "id": "ops.file_asset", "name": "OPS File Asset", "surface": "ops", "status": ["source-evidenced"], "authority": "OPS Product", "summary": "File attached/linked through OPS." },
|
||||
{ "id": "ops.stored_blob", "name": "OPS Stored Blob", "surface": "ops", "status": ["source-evidenced"], "authority": "OPS Product", "summary": "Storage-level blob behind file assets." },
|
||||
|
||||
{ "id": "agent.identity", "name": "Agent Identity", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Gateway execution identity, not user/persona." },
|
||||
{ "id": "agent.token", "name": "Agent Token", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Opaque credential." },
|
||||
{ "id": "agent.session", "name": "Agent Session", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Runtime/session envelope for agent operations." },
|
||||
{ "id": "agent.grant", "name": "Agent Grant", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Permission grant for agent identity/session." },
|
||||
{ "id": "agent.token_grant", "name": "Token Grant", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Token-to-grant binding." },
|
||||
{ "id": "agent.scope", "name": "Agent Scope", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Tool/capability permission." },
|
||||
{ "id": "agent.denied_capability", "name": "Denied Capability", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Explicitly unavailable operation." },
|
||||
{ "id": "agent.mcp_tool", "name": "MCP Tool", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Exposed callable tool surface." },
|
||||
{ "id": "agent.idempotency_key", "name": "Idempotency Key", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Required write-safety key." },
|
||||
{ "id": "agent.audit_event", "name": "Agent Audit Event", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Audit trail for agent actions." },
|
||||
{ "id": "agent.tasker_adapter", "name": "Tasker Adapter", "surface": "agent", "status": ["source-confirmed"], "authority": "OPS Gateway", "summary": "Adapter to Tasker/OPS product API." },
|
||||
{ "id": "agent.setup_packet", "name": "Agent Setup Packet", "surface": "agent", "status": ["source-evidenced"], "authority": "OPS Gateway", "summary": "Setup payload for client app/tool access." },
|
||||
{ "id": "agent.ai_workspace_entitlement", "name": "AI Workspace Entitlement", "surface": "agent", "status": ["source-evidenced", "pending"], "authority": "HUB/OPS Gateway", "summary": "Entitlement/access context for AI workspace." },
|
||||
{ "id": "agent.pairing_code", "name": "Pairing Code", "surface": "agent", "status": ["source-evidenced", "pending"], "authority": "OPS Gateway", "summary": "Pairing/setup flow candidate." },
|
||||
|
||||
{ "id": "engine.workflow_l1", "name": "ENGINE L1 Workflow", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "NodeDC canvas/workflow graph." },
|
||||
{ "id": "engine.node_l1", "name": "ENGINE L1 Node", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "React Flow node in L1 graph." },
|
||||
{ "id": "engine.edge_l1", "name": "ENGINE L1 Edge", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "React Flow edge in L1 graph." },
|
||||
{ "id": "engine.node_type_l1", "name": "ENGINE L1 Node Type", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "Auto-registered node type/module." },
|
||||
{ "id": "engine.workflow_acl", "name": "ENGINE Workflow ACL", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "Workflow-level ACL." },
|
||||
{ "id": "engine.workflow_owner", "name": "ENGINE Workflow Owner", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "Owner field in ACL." },
|
||||
{ "id": "engine.workflow_share", "name": "ENGINE Workflow Share", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "Share/invite/user access routes." },
|
||||
{ "id": "engine.workflow_access_request", "name": "ENGINE Workflow Access Request", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE", "summary": "Access request route/model for workflow access." },
|
||||
{ "id": "engine.workflow_l2", "name": "ENGINE L2 Workflow", "surface": "engine", "status": ["source-evidenced"], "authority": "ENGINE/n8n bridge", "summary": "n8n subworkflow attached to L1 node." },
|
||||
{ "id": "engine.node_l2", "name": "ENGINE L2 Node", "surface": "engine", "status": ["source-evidenced"], "authority": "ENGINE/n8n bridge", "summary": "Node inside compiled/deployed n8n workflow." },
|
||||
{ "id": "engine.l2_runtime_core", "name": "ENGINE L2 Runtime Core", "surface": "engine", "status": ["source-evidenced"], "authority": "ENGINE/n8n bridge", "summary": "Target n8n runtime/core instance." },
|
||||
{ "id": "engine.workflow_l2_runtime_id", "name": "ENGINE L2 Runtime Workflow ID", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE/n8n bridge", "summary": "n8n runtime workflow id, separate from NodeDC workflow id." },
|
||||
{ "id": "engine.l2_execution", "name": "ENGINE L2 Execution", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE/n8n bridge", "summary": "n8n execution id mapped to run/execution records." },
|
||||
{ "id": "engine.l2_run", "name": "ENGINE L2 Run", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE-side OpsLayer", "summary": "Runtime run id; tech-debt-adjacent." },
|
||||
{ "id": "engine.l2_session", "name": "ENGINE L2 Session", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE-side OpsLayer", "summary": "Runtime session anchor." },
|
||||
{ "id": "engine.l2_runtime_event", "name": "ENGINE L2 Runtime Event", "surface": "engine", "status": ["source-confirmed"], "authority": "ENGINE/n8n bridge", "summary": "Runtime event: workflow/node start/finish/success/error." },
|
||||
{ "id": "engine.source_stamp", "name": "ENGINE Source Stamp", "surface": "engine", "status": ["pending"], "authority": "ENGINE", "summary": "Future source/version traceability candidate." },
|
||||
|
||||
{ "id": "assistant.assistant", "name": "Assistant", "surface": "assistant", "status": ["product-required", "pending"], "authority": "AI Workspace", "summary": "User-facing assistant capability/persona." },
|
||||
{ "id": "assistant.provider", "name": "Assistant Provider", "surface": "assistant", "status": ["product-required", "pending"], "authority": "AI Workspace", "summary": "Model/provider integration boundary." },
|
||||
{ "id": "assistant.executor", "name": "Assistant Executor", "surface": "assistant", "status": ["product-required", "pending"], "authority": "AI Workspace/Codex/MCP", "summary": "Execution adapter." },
|
||||
{ "id": "assistant.thread", "name": "Assistant Thread", "surface": "assistant", "status": ["product-required", "pending"], "authority": "AI Workspace", "summary": "Conversation context." },
|
||||
{ "id": "assistant.message", "name": "Assistant Message", "surface": "assistant", "status": ["product-required", "pending"], "authority": "AI Workspace", "summary": "Message unit in thread." },
|
||||
{ "id": "assistant.bridge", "name": "Assistant Bridge", "surface": "assistant", "status": ["product-required", "pending"], "authority": "AI Workspace/OPS Gateway", "summary": "Bridge between assistant, ontology, gateway, Codex, and Engine." },
|
||||
{ "id": "assistant.core_access", "name": "NDC Core Assistant Access", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "HUB/Launcher", "summary": "Per-user assistant availability and permission overlay." },
|
||||
{ "id": "assistant.access_role", "name": "Assistant Access Role", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "HUB/Launcher", "summary": "Assistant role vocabulary: blocked, member, admin." },
|
||||
{ "id": "assistant.role_assignment", "name": "Assistant Role Assignment", "surface": "assistant", "status": ["product-required", "pending"], "authority": "HUB/Launcher", "summary": "Scoped assignment of an assistant access role to a HUB user." },
|
||||
{ "id": "assistant.capability", "name": "Assistant Capability", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "Ontology Core/HUB/OPS Gateway", "summary": "Action-level capability exposed to an assistant." },
|
||||
{ "id": "assistant.permission_policy", "name": "Assistant Permission Policy", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "Ontology Core", "summary": "Policy that maps assistant role plus HUB admin scope to allowed capabilities." },
|
||||
{ "id": "assistant.admin_scope", "name": "Assistant Admin Scope", "surface": "assistant", "status": ["product-required", "source-evidenced"], "authority": "HUB/Launcher", "summary": "Launcher-derived root/client admin boundary available to assistant-admin commands." },
|
||||
{ "id": "assistant.action_request", "name": "Assistant Action Request", "surface": "assistant", "status": ["product-required", "pending"], "authority": "AI Workspace/OPS Gateway", "summary": "A requested assistant operation before policy and gateway enforcement." },
|
||||
{ "id": "assistant.action", "name": "Assistant Action", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "Ontology Core", "summary": "Declarative action card used by assistant command routing." },
|
||||
{ "id": "assistant.action_registry", "name": "Assistant Action Registry", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "Ontology Core", "summary": "Catalog of assistant actions across HUB, OPS Product, ENGINE, and Gateway." },
|
||||
{ "id": "assistant.risk_policy", "name": "Assistant Risk Policy", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "Ontology Core", "summary": "Risk classification and hard-deny policy for assistant actions." },
|
||||
{ "id": "assistant.app_adapter", "name": "Assistant App Adapter", "surface": "assistant", "status": ["product-required", "pending"], "authority": "Platform Apps", "summary": "Application-owned execution adapter for an approved assistant action." },
|
||||
{ "id": "assistant.confirmation_policy", "name": "Assistant Confirmation Policy", "surface": "assistant", "status": ["product-required", "owner-confirmed"], "authority": "Ontology Core", "summary": "Rules for when assistant actions require explicit confirmation." },
|
||||
|
||||
{ "id": "future.interface_layer", "name": "Future Interface Layer", "surface": "future", "status": ["owner-confirmed", "future-concept"], "authority": "Platform", "summary": "Dedicated automation UI/workview layer." },
|
||||
{ "id": "future.interface_view", "name": "Interface View", "surface": "future", "status": ["future-concept"], "authority": "Interface Layer", "summary": "Generated/configured view over ontology-backed domain data." },
|
||||
{ "id": "future.interface_widget", "name": "Interface Widget", "surface": "future", "status": ["future-concept"], "authority": "Interface Layer", "summary": "Map, table, analytics block, form, graph, control, etc." },
|
||||
{ "id": "future.interface_binding", "name": "Interface Binding", "surface": "future", "status": ["future-concept"], "authority": "Interface Layer/ENGINE", "summary": "Binding from workflow/node output to interface layer." },
|
||||
{ "id": "future.domain_package", "name": "Domain Ontology Package", "surface": "future", "status": ["future-concept"], "authority": "Ontology Core", "summary": "Domain extension package." },
|
||||
|
||||
{ "id": "engine.tech_debt.ops_layer", "name": "ENGINE OpsLayer Tech Debt", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "Current ENGINE-side operational/runtime layer; not OPS Product." },
|
||||
{ "id": "engine.tech_debt.ops_agent_instance", "name": "ENGINE Ops Agent Instance", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "Local runtime agent instance; not OPS Gateway agent.identity." },
|
||||
{ "id": "engine.tech_debt.agent_monitor_node", "name": "Agent Monitor Node", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "Current monitor/control UI experiment." },
|
||||
{ "id": "engine.tech_debt.monitor_profile", "name": "Monitor Profile", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "Current profile/config around Agent Monitor." },
|
||||
{ "id": "engine.tech_debt.tender_domain_ui", "name": "Tender Domain UI", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "Hardcoded tender/procurement UI in ENGINE." },
|
||||
{ "id": "engine.tech_debt.tender_storage", "name": "Tender Storage", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "Current domain storage in ENGINE-side implementation." },
|
||||
{ "id": "engine.tech_debt.tender_ai_review", "name": "Tender AI Review", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "Current AI review implementation for tender domain." },
|
||||
{ "id": "engine.tech_debt.ops_tabs_control", "name": "ENGINE OPS Tabs Control", "surface": "engine", "status": ["tech-debt-noncanonical"], "authority": "ENGINE", "summary": "UI/control surface tied to current OpsLayer experiment." }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,31 @@
|
||||
{
|
||||
"version": "0.4-pre",
|
||||
"updatedAt": "2026-06-19",
|
||||
"sourceRoots": [
|
||||
{ "surface": "hub", "path": "/Users/dcconstructions/Downloads/mnt/data/nodedc_launcher", "mode": "read-only source inspection" },
|
||||
{ "surface": "ops", "path": "/Users/dcconstructions/Downloads/mnt/data/dc_taskmanager/NODEDC_TASKMANAGER", "mode": "read-only source inspection" },
|
||||
{ "surface": "agent", "path": "/Users/dcconstructions/Downloads/mnt/data/NODEDC_TASKMANAGER_CODEXAPI", "mode": "read-only source inspection" },
|
||||
{ "surface": "engine", "path": "/Users/dcconstructions/Downloads/mnt/NODEDC/NODEDC_ENGINE_INFRA/nodedc-source", "mode": "read-only source inspection" },
|
||||
{ "surface": "ontology", "path": "/Users/dcconstructions/Downloads/mnt/NODEDC_ONTOLOGY", "mode": "documentation workspace" }
|
||||
],
|
||||
"ledgers": [
|
||||
{ "id": "ledger.hub_p0", "path": "docs/baseline/EVIDENCE_LEDGER_HUB_P0.md", "entityIds": ["hub.open_contour", "hub.public_pool_context", "hub.public_pool_client", "hub.user", "hub.application", "ndcauth.identity", "ndcauth.session"] },
|
||||
{ "id": "ledger.ops_p0", "path": "docs/baseline/EVIDENCE_LEDGER_OPS_P0.md", "entityIds": ["ops.workspace", "ops.project", "ops.card", "ops.card_status", "ops.card_priority", "ops.assignee", "ops.card_relation"] },
|
||||
{ "id": "ledger.ops_gateway_p1", "path": "docs/baseline/EVIDENCE_LEDGER_OPS_GATEWAY_P1.md", "entityIds": ["agent.identity", "agent.token", "agent.grant", "agent.scope", "agent.mcp_tool", "agent.audit_event", "agent.idempotency_key"] },
|
||||
{ "id": "ledger.engine_dirty_boundary_p1", "path": "docs/baseline/EVIDENCE_LEDGER_ENGINE_DIRTY_BOUNDARY_P1.md", "entityIds": ["engine.tech_debt.ops_layer", "engine.tech_debt.agent_monitor_node", "engine.tech_debt.tender_domain_ui", "future.interface_layer"] },
|
||||
{ "id": "ledger.engine_workflow_p1", "path": "docs/baseline/EVIDENCE_LEDGER_ENGINE_WORKFLOW_P1.md", "entityIds": ["engine.workflow_l1", "engine.node_l1", "engine.edge_l1", "engine.workflow_l2", "engine.workflow_l2_runtime_id", "engine.l2_execution", "engine.l2_run", "engine.l2_session", "engine.l2_runtime_event"] }
|
||||
],
|
||||
"baselineDocs": [
|
||||
"docs/baseline/CANONICAL_ENTITY_CATALOG.md",
|
||||
"docs/baseline/RELATION_CATALOG.md",
|
||||
"docs/baseline/GUARDRAILS.md",
|
||||
"docs/baseline/TERMS_GLOSSARY.md",
|
||||
"docs/baseline/IMPLEMENTATION_READINESS.md",
|
||||
"docs/baseline/OPEN_QUESTIONS.md"
|
||||
],
|
||||
"restrictions": [
|
||||
"Do not ingest env/secrets/runtime/data/storage/logs/dumps.",
|
||||
"Do not edit HUB/OPS/Gateway/ENGINE source code from this service task.",
|
||||
"Do not treat browser ChatGPT RFCs as source truth without evidence ledger update."
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,108 @@
|
||||
{
|
||||
"version": "0.4-pre",
|
||||
"updatedAt": "2026-06-19",
|
||||
"rules": [
|
||||
{
|
||||
"id": "guardrail.ops.must_qualify_ops_term",
|
||||
"severity": "error",
|
||||
"summary": "Do not say OPS without specifying OPS Product, OPS Gateway, or ENGINE-side OpsLayer.",
|
||||
"entityIds": ["ops.card", "agent.identity", "engine.tech_debt.ops_layer"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.ops.card_is_root_work_object",
|
||||
"severity": "error",
|
||||
"summary": "Use ops.card as canonical work object; issue/task/work item are aliases or subtypes.",
|
||||
"entityIds": ["ops.card", "ops.card_type"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.hub.open_contour_not_client_context",
|
||||
"severity": "error",
|
||||
"summary": "hub.open_contour is not an ordinary hub.client_context.",
|
||||
"entityIds": ["hub.open_contour", "hub.client_context", "hub.public_pool_client"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.hub.application_card_not_authority",
|
||||
"severity": "error",
|
||||
"summary": "hub.application_card is presentation only; access authority belongs to application_access/grant/exception.",
|
||||
"entityIds": ["hub.application_card", "hub.application_access", "hub.app_grant", "hub.app_exception"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.gateway.identity_not_user_or_assistant",
|
||||
"severity": "error",
|
||||
"summary": "agent.identity is Gateway execution identity, not human user and not assistant persona.",
|
||||
"entityIds": ["agent.identity", "hub.user", "assistant.assistant"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.gateway_enforces_permissions",
|
||||
"severity": "error",
|
||||
"summary": "Ontology advises context; OPS Gateway enforces grants, scopes, audit, and idempotency.",
|
||||
"entityIds": ["agent.grant", "agent.scope", "agent.audit_event", "agent.idempotency_key", "assistant.bridge"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.engine.l1_l2_runtime_ids_are_distinct",
|
||||
"severity": "error",
|
||||
"summary": "engine.workflow_l1 id, engine.workflow_l2, and engine.workflow_l2_runtime_id are distinct concepts.",
|
||||
"entityIds": ["engine.workflow_l1", "engine.workflow_l2", "engine.workflow_l2_runtime_id"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.engine.ops_layer_noncanonical",
|
||||
"severity": "error",
|
||||
"summary": "ENGINE-side OpsLayer/Agent Monitor/tender UI are current tech debt and must not define OPS Product ontology.",
|
||||
"entityIds": ["engine.tech_debt.ops_layer", "engine.tech_debt.agent_monitor_node", "engine.tech_debt.tender_domain_ui", "ops.card"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.interface_layer_not_engine_core_ui",
|
||||
"severity": "warning",
|
||||
"summary": "Future automation UI belongs in a dedicated Interface Layer, not hardcoded inside ENGINE core.",
|
||||
"entityIds": ["future.interface_layer", "future.interface_view", "future.interface_binding", "engine.workflow_l1"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.assistant_role_never_bypasses_launcher_scope",
|
||||
"severity": "error",
|
||||
"summary": "Assistant admin role unlocks assistant-admin commands only inside existing Launcher root/client admin scope.",
|
||||
"entityIds": ["assistant.access_role", "assistant.admin_scope", "hub.membership", "hub.role"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.assistant_blocked_hides_all_surfaces",
|
||||
"severity": "error",
|
||||
"summary": "Blocked assistant access means no assistant icon/surface and no assistant capability in HUB, OPS Product, ENGINE, or Gateway flows.",
|
||||
"entityIds": ["assistant.core_access", "assistant.access_role", "assistant.capability"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.assistant_member_not_admin",
|
||||
"severity": "error",
|
||||
"summary": "Assistant member mode allows personal/basic assistant use but not user, role, invite, or cross-user access administration.",
|
||||
"entityIds": ["assistant.access_role", "assistant.capability", "hub.user", "hub.invite"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.assistant_actions_must_be_registered",
|
||||
"severity": "error",
|
||||
"summary": "Assistant must resolve user requests to registered action cards before policy checks or execution.",
|
||||
"entityIds": ["assistant.action_registry", "assistant.action", "assistant.action_request"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.assistant_never_hard_deletes",
|
||||
"severity": "error",
|
||||
"summary": "Assistant actions must not hard-delete users, records, database rows, files, or production state.",
|
||||
"entityIds": ["assistant.action", "assistant.risk_policy", "hub.user", "ops.card", "engine.workflow_l1"]
|
||||
},
|
||||
{
|
||||
"id": "guardrail.assistant_no_self_lockout",
|
||||
"severity": "error",
|
||||
"summary": "Assistant must not allow a user to remove, block, or disable their own last admin/access path.",
|
||||
"entityIds": ["assistant.action", "assistant.admin_scope", "hub.membership", "hub.user"]
|
||||
}
|
||||
],
|
||||
"blockedConflations": [
|
||||
["ops.card", "engine.tech_debt.ops_layer"],
|
||||
["agent.identity", "hub.user"],
|
||||
["agent.identity", "assistant.assistant"],
|
||||
["assistant.access_role", "hub.role"],
|
||||
["assistant.admin_scope", "agent.grant"],
|
||||
["assistant.action", "assistant.capability"],
|
||||
["hub.open_contour", "hub.client_context"],
|
||||
["hub.application_card", "hub.application_access"],
|
||||
["engine.workflow_l1", "engine.workflow_l2_runtime_id"],
|
||||
["future.interface_layer", "engine.tech_debt.tender_domain_ui"]
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,81 @@
|
||||
{
|
||||
"version": "0.4-pre",
|
||||
"updatedAt": "2026-06-19",
|
||||
"relations": [
|
||||
{ "id": "hub.open_contour.uses_public_pool", "from": ["hub.open_contour"], "to": ["hub.public_pool_context"], "status": "source-evidenced", "summary": "Open contour is implemented through public pool context." },
|
||||
{ "id": "hub.public_pool_context.backed_by_client", "from": ["hub.public_pool_context"], "to": ["hub.public_pool_client"], "status": "source-confirmed", "summary": "Public pool context uses special source-backed Client." },
|
||||
{ "id": "hub.user.has_membership", "from": ["hub.user"], "to": ["hub.membership"], "status": "source-confirmed", "summary": "User belongs to context through membership." },
|
||||
{ "id": "hub.membership.in_context", "from": ["hub.membership"], "to": ["hub.client_context", "hub.public_pool_context"], "status": "source-confirmed", "summary": "Membership points to closed client context or public pool." },
|
||||
{ "id": "hub.access_request.targets_context", "from": ["hub.access_request"], "to": ["hub.client_context", "hub.public_pool_context"], "status": "source-confirmed", "summary": "Request targets a context." },
|
||||
{ "id": "hub.public_access_request.promotes_to_client_context", "from": ["hub.public_access_request"], "to": ["hub.client_context"], "status": "source-confirmed", "summary": "Public request can become client membership after approval." },
|
||||
{ "id": "hub.invite.targets_context", "from": ["hub.invite"], "to": ["hub.client_context", "hub.public_pool_context"], "status": "source-confirmed", "summary": "Invite targets a context." },
|
||||
{ "id": "hub.application.has_access_result", "from": ["hub.application"], "to": ["hub.application_access"], "status": "source-confirmed", "summary": "Application exposes effective access state." },
|
||||
{ "id": "hub.app_grant.grants_access_to", "from": ["hub.app_grant"], "to": ["hub.application"], "status": "source-confirmed", "summary": "Grant contributes to effective access." },
|
||||
{ "id": "hub.app_exception.overrides_access_to", "from": ["hub.app_exception"], "to": ["hub.application"], "status": "source-confirmed", "summary": "User-specific allow/deny exception." },
|
||||
{ "id": "hub.application_card.presents", "from": ["hub.application_card"], "to": ["hub.application"], "status": "source-confirmed", "summary": "UI card presents app plus access state." },
|
||||
{ "id": "ndcauth.identity.maps_to_hub_user", "from": ["ndcauth.identity"], "to": ["hub.user"], "status": "source-confirmed", "summary": "Auth subject resolves to launcher user." },
|
||||
|
||||
{ "id": "ops.workspace.contains_project", "from": ["ops.workspace"], "to": ["ops.project"], "status": "source-confirmed", "summary": "Project belongs to workspace." },
|
||||
{ "id": "ops.workspace.has_member", "from": ["ops.workspace"], "to": ["ops.workspace_member"], "status": "source-confirmed", "summary": "Workspace membership." },
|
||||
{ "id": "ops.project.has_member", "from": ["ops.project"], "to": ["ops.project_member"], "status": "source-confirmed", "summary": "Project membership." },
|
||||
{ "id": "ops.project.contains_card", "from": ["ops.project"], "to": ["ops.card"], "status": "source-confirmed", "summary": "Card belongs to project." },
|
||||
{ "id": "ops.card.has_status", "from": ["ops.card"], "to": ["ops.card_status"], "status": "source-confirmed", "summary": "Card state." },
|
||||
{ "id": "ops.card.has_priority", "from": ["ops.card"], "to": ["ops.card_priority"], "status": "source-confirmed", "summary": "Card priority attribute." },
|
||||
{ "id": "ops.card.assigned_to", "from": ["ops.card"], "to": ["ops.assignee"], "status": "source-confirmed", "summary": "Card assignment." },
|
||||
{ "id": "ops.card.accountable_to", "from": ["ops.card"], "to": ["ops.responsible"], "status": "product-required", "summary": "Product-level responsibility relation." },
|
||||
{ "id": "ops.card.typed_as", "from": ["ops.card"], "to": ["ops.card_type"], "status": "source-evidenced", "summary": "Card subtype/purpose." },
|
||||
{ "id": "ops.card.related_to", "from": ["ops.card"], "to": ["ops.card_relation"], "status": "source-confirmed", "summary": "Relation/dependency between cards." },
|
||||
{ "id": "ops.card.has_label", "from": ["ops.card"], "to": ["ops.card_label"], "status": "source-confirmed", "summary": "Label/tag classification." },
|
||||
{ "id": "ops.card.has_comment", "from": ["ops.card"], "to": ["ops.card_comment"], "status": "source-confirmed", "summary": "Discussion/comment relation." },
|
||||
{ "id": "ops.card.has_activity", "from": ["ops.card"], "to": ["ops.card_activity"], "status": "source-evidenced", "summary": "Timeline/change relation." },
|
||||
{ "id": "ops.card.links_artifact", "from": ["ops.card"], "to": ["ops.card_artifact_link"], "status": "source-evidenced", "summary": "Links output artifacts or docs." },
|
||||
{ "id": "ops.card.has_external_ref", "from": ["ops.card"], "to": ["ops.external_ref"], "status": "source-confirmed", "summary": "Links external/source object." },
|
||||
|
||||
{ "id": "agent.token.represents_identity", "from": ["agent.token"], "to": ["agent.identity"], "status": "source-confirmed", "summary": "Token authenticates agent identity, not user identity." },
|
||||
{ "id": "agent.identity.has_grant", "from": ["agent.identity"], "to": ["agent.grant"], "status": "source-confirmed", "summary": "Identity receives grants." },
|
||||
{ "id": "agent.token.has_token_grant", "from": ["agent.token"], "to": ["agent.token_grant"], "status": "source-confirmed", "summary": "Token-level grant binding." },
|
||||
{ "id": "agent.grant.allows_scope", "from": ["agent.grant"], "to": ["agent.scope"], "status": "source-confirmed", "summary": "Grant enables tool/capability scope." },
|
||||
{ "id": "agent.scope.exposes_tool", "from": ["agent.scope"], "to": ["agent.mcp_tool"], "status": "source-confirmed", "summary": "Scope controls MCP tool exposure." },
|
||||
{ "id": "agent.mcp_tool.writes_via_adapter", "from": ["agent.mcp_tool"], "to": ["agent.tasker_adapter"], "status": "source-confirmed", "summary": "Gateway writes to OPS through adapter." },
|
||||
{ "id": "agent.mcp_tool.requires_idempotency", "from": ["agent.mcp_tool"], "to": ["agent.idempotency_key"], "status": "source-confirmed", "summary": "Write operations require idempotency." },
|
||||
{ "id": "agent.mcp_tool.emits_audit", "from": ["agent.mcp_tool"], "to": ["agent.audit_event"], "status": "source-confirmed", "summary": "Operations produce audit records." },
|
||||
{ "id": "agent.setup_packet.provisions_token", "from": ["agent.setup_packet"], "to": ["agent.token"], "status": "source-evidenced", "summary": "Setup flow produces token/connect config." },
|
||||
|
||||
{ "id": "engine.workflow_l1.contains_node", "from": ["engine.workflow_l1"], "to": ["engine.node_l1"], "status": "source-confirmed", "summary": "L1 workflow graph contains nodes." },
|
||||
{ "id": "engine.workflow_l1.contains_edge", "from": ["engine.workflow_l1"], "to": ["engine.edge_l1"], "status": "source-confirmed", "summary": "L1 workflow graph contains edges." },
|
||||
{ "id": "engine.edge_l1.connects_nodes", "from": ["engine.edge_l1"], "to": ["engine.node_l1"], "status": "source-confirmed", "summary": "Edge connects source/target node handles." },
|
||||
{ "id": "engine.node_l1.has_type", "from": ["engine.node_l1"], "to": ["engine.node_type_l1"], "status": "source-confirmed", "summary": "Node type comes from registry/module." },
|
||||
{ "id": "engine.workflow_l1.has_acl", "from": ["engine.workflow_l1"], "to": ["engine.workflow_acl"], "status": "source-confirmed", "summary": "Workflow uses access control." },
|
||||
{ "id": "engine.workflow_acl.has_owner", "from": ["engine.workflow_acl"], "to": ["engine.workflow_owner"], "status": "source-confirmed", "summary": "ACL owns owner field." },
|
||||
{ "id": "engine.workflow_l1.has_share", "from": ["engine.workflow_l1"], "to": ["engine.workflow_share"], "status": "source-confirmed", "summary": "Workflow can be shared/invited." },
|
||||
{ "id": "engine.workflow_l1.has_access_request", "from": ["engine.workflow_l1"], "to": ["engine.workflow_access_request"], "status": "source-confirmed", "summary": "Access requests target workflow." },
|
||||
{ "id": "engine.node_l1.embeds_l2_workflow", "from": ["engine.node_l1"], "to": ["engine.workflow_l2"], "status": "source-evidenced", "summary": "n8n subworkflow is attached to L1 node." },
|
||||
{ "id": "engine.workflow_l2.deployed_as_runtime_workflow", "from": ["engine.workflow_l2"], "to": ["engine.workflow_l2_runtime_id"], "status": "source-confirmed", "summary": "Compiled n8n workflow deploy returns runtime workflow id." },
|
||||
{ "id": "engine.workflow_l2.runs_on_runtime_core", "from": ["engine.workflow_l2"], "to": ["engine.l2_runtime_core"], "status": "source-evidenced", "summary": "L2 workflow targets n8n instance/core." },
|
||||
{ "id": "engine.l2_execution.belongs_to_runtime_workflow", "from": ["engine.l2_execution"], "to": ["engine.workflow_l2_runtime_id"], "status": "source-confirmed", "summary": "Execution is emitted for n8n workflow id." },
|
||||
{ "id": "engine.l2_runtime_event.describes_execution", "from": ["engine.l2_runtime_event"], "to": ["engine.l2_execution"], "status": "source-confirmed", "summary": "Runtime events carry execution id." },
|
||||
{ "id": "engine.l2_runtime_event.binds_run", "from": ["engine.l2_runtime_event"], "to": ["engine.l2_run"], "status": "source-confirmed", "summary": "Event binds to run id. Current storage is ENGINE-side OpsLayer." },
|
||||
{ "id": "engine.l2_run.has_session", "from": ["engine.l2_run"], "to": ["engine.l2_session"], "status": "source-confirmed", "summary": "Session anchors related runtime events/runs." },
|
||||
|
||||
{ "id": "assistant.core_access.assigned_by_role_assignment", "from": ["assistant.core_access"], "to": ["assistant.role_assignment"], "status": "product-required", "summary": "Assistant access is materialized as a scoped role assignment." },
|
||||
{ "id": "assistant.role_assignment.targets_user", "from": ["assistant.role_assignment"], "to": ["hub.user"], "status": "product-required", "summary": "Assistant role assignment targets a HUB user." },
|
||||
{ "id": "assistant.role_assignment.has_role", "from": ["assistant.role_assignment"], "to": ["assistant.access_role"], "status": "product-required", "summary": "Assignment grants one assistant access role." },
|
||||
{ "id": "assistant.role_assignment.scoped_to_context", "from": ["assistant.role_assignment"], "to": ["hub.client_context", "hub.public_pool_context"], "status": "product-required", "summary": "Assistant role assignment may be scoped to a client or public-pool context." },
|
||||
{ "id": "assistant.access_role.allows_capability", "from": ["assistant.access_role"], "to": ["assistant.capability"], "status": "product-required", "summary": "Role contributes assistant capabilities before scope guards are applied." },
|
||||
{ "id": "assistant.permission_policy.derives_admin_scope", "from": ["assistant.permission_policy"], "to": ["assistant.admin_scope"], "status": "source-evidenced", "summary": "Policy derives assistant-admin authority from Launcher admin scope." },
|
||||
{ "id": "assistant.admin_scope.derived_from_hub_membership", "from": ["assistant.admin_scope"], "to": ["hub.membership", "hub.role"], "status": "source-evidenced", "summary": "Client admin scope comes from active client_owner/client_admin membership." },
|
||||
{ "id": "assistant.action_request.checked_by_permission_policy", "from": ["assistant.action_request"], "to": ["assistant.permission_policy"], "status": "product-required", "summary": "Requested assistant action must pass assistant policy first." },
|
||||
{ "id": "assistant.action_request.executes_through_bridge", "from": ["assistant.action_request"], "to": ["assistant.bridge", "agent.mcp_tool"], "status": "product-required", "summary": "Approved assistant action still executes through bridge/gateway tooling." },
|
||||
{ "id": "assistant.action_registry.contains_action", "from": ["assistant.action_registry"], "to": ["assistant.action"], "status": "product-required", "summary": "Registry owns declarative assistant action cards." },
|
||||
{ "id": "assistant.action.classified_by_risk_policy", "from": ["assistant.action"], "to": ["assistant.risk_policy"], "status": "product-required", "summary": "Every assistant action has risk classification and policy gates." },
|
||||
{ "id": "assistant.action.requires_confirmation_policy", "from": ["assistant.action"], "to": ["assistant.confirmation_policy"], "status": "product-required", "summary": "Action card declares confirmation requirements before execution." },
|
||||
{ "id": "assistant.action.executed_by_adapter", "from": ["assistant.action"], "to": ["assistant.app_adapter"], "status": "product-required", "summary": "Application-owned adapter executes an approved action." },
|
||||
{ "id": "assistant.action_request.resolves_to_action", "from": ["assistant.action_request"], "to": ["assistant.action"], "status": "product-required", "summary": "Natural-language request must resolve to a known action card before any execution." },
|
||||
|
||||
{ "id": "ontology.resolves_ops_card_to_engine_context", "from": ["ops.card"], "to": ["engine.workflow_l1", "engine.workflow_l2"], "status": "product-required", "summary": "Assistant in OPS can route a request to Engine workflow context." },
|
||||
{ "id": "ontology.resolves_engine_context_to_ops_project", "from": ["engine.workflow_l1", "engine.workflow_l2"], "to": ["ops.project"], "status": "product-required", "summary": "Assistant in Engine can create/update cards in the correct OPS project." },
|
||||
{ "id": "ontology.resolves_hub_app_to_project_context", "from": ["hub.application"], "to": ["ops.project", "engine.workflow_l1"], "status": "product-required", "summary": "Application selection can suggest project/workflow context." },
|
||||
{ "id": "ontology.selects_gateway_grant_context", "from": ["assistant.bridge"], "to": ["agent.grant"], "status": "product-required", "summary": "Ontology can help choose proper MCP/Gateway grant before tool calls." },
|
||||
{ "id": "ontology.routes_interface_view_to_domain_package", "from": ["future.interface_view"], "to": ["future.domain_package"], "status": "future-concept", "summary": "Future UI layer renders domain-specific views from ontology-backed data." }
|
||||
]
|
||||
}
|
||||
@@ -0,0 +1,51 @@
|
||||
{
|
||||
"version": "0.1.0",
|
||||
"updatedAt": "2026-06-19",
|
||||
"rules": [
|
||||
{
|
||||
"id": "resolver.ops_to_engine.workflow_context",
|
||||
"relationId": "ontology.resolves_ops_card_to_engine_context",
|
||||
"fromSurface": "ops",
|
||||
"inputEntityIds": ["ops.card", "ops.project"],
|
||||
"intentHints": ["engine", "workflow", "l1", "l2", "n8n", "inspect", "switch", "runtime", "докодим", "воркфлоу"],
|
||||
"outputSurface": "engine",
|
||||
"outputEntityIds": ["engine.workflow_l1", "engine.node_l1", "engine.workflow_l2", "engine.workflow_l2_runtime_id"],
|
||||
"requiredBindings": [
|
||||
"ops.card -> ops.external_ref -> engine.workflow_l1|engine.workflow_l2",
|
||||
"ops.project -> hub.application|engine.workflow_l1 context"
|
||||
],
|
||||
"status": "product-required",
|
||||
"summary": "Route an OPS card/project request into Engine workflow context."
|
||||
},
|
||||
{
|
||||
"id": "resolver.engine_to_ops.card_context",
|
||||
"relationId": "ontology.resolves_engine_context_to_ops_project",
|
||||
"fromSurface": "engine",
|
||||
"inputEntityIds": ["engine.workflow_l1", "engine.node_l1", "engine.workflow_l2", "engine.l2_runtime_event"],
|
||||
"intentHints": ["ops", "card", "task", "issue", "project", "report", "создай", "карточ", "задач"],
|
||||
"outputSurface": "ops",
|
||||
"outputEntityIds": ["ops.workspace", "ops.project", "ops.card", "ops.card_type"],
|
||||
"requiredBindings": [
|
||||
"engine.workflow_l1 -> ops.project",
|
||||
"engine.workflow_l1|engine.node_l1 -> ops.card external_ref"
|
||||
],
|
||||
"status": "product-required",
|
||||
"summary": "Route an Engine workflow/node request into OPS project/card context."
|
||||
},
|
||||
{
|
||||
"id": "resolver.gateway_preflight.context_grant",
|
||||
"relationId": "ontology.selects_gateway_grant_context",
|
||||
"fromSurface": "assistant",
|
||||
"inputEntityIds": ["assistant.bridge", "assistant.executor"],
|
||||
"intentHints": ["mcp", "gateway", "grant", "tool", "token"],
|
||||
"outputSurface": "agent",
|
||||
"outputEntityIds": ["agent.grant", "agent.scope", "agent.mcp_tool", "agent.idempotency_key"],
|
||||
"requiredBindings": [
|
||||
"assistant.bridge -> target surface context",
|
||||
"target context -> agent.grant"
|
||||
],
|
||||
"status": "product-required",
|
||||
"summary": "Suggest Gateway grant/tool context before MCP calls; Gateway remains enforcement authority."
|
||||
}
|
||||
]
|
||||
}
|
||||
Reference in New Issue
Block a user