From 238d552036c7bb5ea28d788d8b2ab044ce0d3c7e Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Thu, 6 Aug 2026 17:26:01 -0500 Subject: [PATCH 001/101] Align organization front door with presentation Reviewer Guide --- README.md | 23 +- architecture/REPO_AUTHORITY_MAP.md | 11 +- architecture/REPRODUCIBLE_REVIEWER_PATH.md | 28 +- governance/COMMAND_CENTER_INVARIANTS.json | 12 + governance/CONTROL_STATUS_MATRIX.md | 4 +- governance/ORG_CI_CD_AUTHORITY_CONTRACT.md | 4 +- profile/README.md | 406 ++++---------------- profile/START_HERE.md | 306 +++++---------- scripts/verify-command-center-invariants.py | 69 ++++ 9 files changed, 297 insertions(+), 566 deletions(-) diff --git a/README.md b/README.md index 6fb7e79..b644369 100644 --- a/README.md +++ b/README.md @@ -27,27 +27,31 @@ Evidence and source flow stay separated: | Time | Start | What to confirm | |---:|---|---| -| 30 sec | [profile/START_HERE.md](profile/START_HERE.md) | What HawkinsOperations is, which repo owns truth, and what remains blocked. | -| 3 min | [profile/README.md](profile/README.md) -> [Control Status Matrix](governance/CONTROL_STATUS_MATRIX.md) | Command-center route, proof ceiling, and standing controls. | -| 10 min | [Reproducible Reviewer Path](architecture/REPRODUCIBLE_REVIEWER_PATH.md) | Clone-runnable source, validation, proof, and rendering review without private runtime access. | +| 30 sec | [Website Reviewer Guide](https://hawkinsoperations.com/) | What HawkinsOperations is and how the complete system works. | +| 3 min | [profile/START_HERE.md](profile/START_HERE.md) | Website, Hoxline, source, validation, proof, and authority boundaries. | +| 10 min | [Focused reviewer path](profile/START_HERE.md#10-minute-reviewer-path) | Run Hoxline's local fixture-based demo, then inspect the HO-DET-001 source, validation, and proof handoffs. | +| Extended | [Reproducible Reviewer Path](architecture/REPRODUCIBLE_REVIEWER_PATH.md) | Full seven-repository source, validation, proof, control, and rendering review without private runtime access. | -## README / Repo Makeover Order +## Seven-Repository Authority -This is the README/governance cleanup order, not evidence-generation order. +Each repository owns one bounded role. The order below is an authority map, not an evidence-strength ranking. | Order | Repo | Truth surface | Boundary | |---:|---|---|---| | 1 | `.github` | Route / governance truth | Routes reviewers and explains authority boundaries; does not prove claims. | -| 2 | `hawkinsoperations-proof` | Claim / proof truth | Owns proof records, proof ceilings, evidence-boundary records, and blocked-claim status. | -| 3 | `hawkinsoperations-platform` | Contract / guardrail truth | Owns schemas, contracts, ledger guardrails, runtime-route guardrails, and non-promotional platform controls. | +| 2 | `hoxline` | Product / ProofOps control | Governs the review path and Claim Authority experience; does not own proof records or final approval. | +| 3 | `hawkinsoperations-detections` | Source truth | Owns detection source, metadata, source reviewability, and source-level eligibility routing. | | 4 | `hawkinsoperations-validation` | Behavior truth | Owns controlled validation checks, case packets, replay scope, and recorded validation outputs. | -| 5 | `hawkinsoperations-detections` | Source truth | Owns detection source, metadata, source reviewability, and source-level eligibility routing. | -| 6 | `hawkinsoperations-website` | Render truth | Renders public reviewer navigation and bounded wording; rendering is not proof. | +| 5 | `hawkinsoperations-platform` | Contract / guardrail truth | Owns schemas, contracts, ledger guardrails, runtime-route guardrails, and non-promotional platform controls. | +| 6 | `hawkinsoperations-proof` | Claim / proof truth | Owns proof records, proof ceilings, evidence-boundary records, and blocked-claim status. | +| 7 | `hawkinsoperations-website` | Render truth | Renders the public Reviewer Guide and bounded reviewer navigation; rendering is not proof. | ## Command Center Routes | Need | Route | Boundary | |---|---|---| +| Visual system presentation | [Website Reviewer Guide](https://hawkinsoperations.com/) | Explains and presents the system; website rendering is not proof. | +| Product / ProofOps control | [Hoxline](https://github.com/HawkinsOperations/hoxline) | Product control surface; not proof authority or final approval. | | First reviewer path | [profile/START_HERE.md](profile/START_HERE.md) | Click path for review and demo; does not promote claims. | | Org front door | [profile/README.md](profile/README.md) | Reviewer routing only; does not create proof. | | Repository authority map | [architecture/REPO_AUTHORITY_MAP.md](architecture/REPO_AUTHORITY_MAP.md) | Repository ownership map; source does not prove runtime. | @@ -90,6 +94,7 @@ This surface does not claim runtime-active public proof, signal-observed public | Repo | Truth surface | Boundary | |---|---|---| +| [hoxline](https://github.com/HawkinsOperations/hoxline) | Product / ProofOps control | Owns the product control experience; does not own proof records, runtime proof, or approval. | | [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof) | Claim / proof truth | Owns proof records, claim ceilings, and blocked-claim status. | | [hawkinsoperations-platform](https://github.com/HawkinsOperations/hawkinsoperations-platform) | Contract / guardrail truth | Owns schemas, contracts, and non-promotional platform controls. | | [hawkinsoperations-validation](https://github.com/HawkinsOperations/hawkinsoperations-validation) | Behavior truth | Owns controlled validation and recorded validation outputs. | diff --git a/architecture/REPO_AUTHORITY_MAP.md b/architecture/REPO_AUTHORITY_MAP.md index 6b50105..af2d639 100644 --- a/architecture/REPO_AUTHORITY_MAP.md +++ b/architecture/REPO_AUTHORITY_MAP.md @@ -24,11 +24,11 @@ Total HawkinsOperations system repos remain seven: - `hawkinsoperations-platform` = contracts/mechanics - `hawkinsoperations-proof` = proof records/claim ceilings - `hawkinsoperations-website` = public rendering -- `hoxline` = current Hoxline product/front-door repo +- `hoxline` = current Hoxline product and ProofOps control repo No eighth repo may be added without explicit approval. -Hoxline by HawkinsOperations is the current product/front-door repo and ProofOps control surface. Hoxline provides ProofOps control for the AI security era and governs how AI-assisted security work becomes tested, reviewed, blocked, or safe to claim. Current repository path: HawkinsOperations/hoxline. AevumGuard was a prior working name. Hoxline is the current product name. Claim Firewall is the first Claim Authority enforcement capability inside Hoxline; it is not the product, platform, front-door repo, an eighth repo, proof authority, runtime proof, or signal proof. +Hoxline by HawkinsOperations is the product and ProofOps control surface. Hoxline provides ProofOps control for the AI security era and governs how AI-assisted security work becomes tested, reviewed, blocked, or safe to claim. Current repository path: HawkinsOperations/hoxline. Claim Firewall is the first Claim Authority enforcement capability inside Hoxline; it is not the product, platform, an eighth repo, proof authority, runtime proof, or signal proof. ## Authority Summary | Repository | Authority plane | Owns | Boundary | @@ -39,14 +39,15 @@ Hoxline by HawkinsOperations is the current product/front-door repo and ProofOps | `hawkinsoperations-platform` | Contracts / orchestration / control logic | Runtime contracts, interface boundaries, and non-promotional guardrails. | Contracts do not prove public proof, production readiness, or current runtime state. | | `hawkinsoperations-proof` | Proof records / evidence truth | Proof records, claim ceilings, evidence boundary records, and cited case packets. | Proof records do not publish raw private evidence or raise ceilings by presentation. | | `hawkinsoperations-website` | Public rendering only | Public reviewer navigation and rendered wording. | Rendering is not proof and cannot approve a claim. | -| `hoxline` | Product / front door | Hoxline product surface and Claim Authority capabilities, starting with Claim Firewall. | Product framing does not prove runtime, signal, evidence, public-safe status, production readiness, or approval. | +| `hoxline` | Product / ProofOps control | Hoxline product surface and Claim Authority capabilities, starting with Claim Firewall. | Product framing does not prove runtime, signal, evidence, public-safe status, production readiness, or approval. | ## Command Center Operating Surfaces | Surface | Route | Owns | Does not own | | --- | --- | --- | --- | | Organization front door | [profile/README.md](../profile/README.md) | High-level reviewer orientation and demo routing. | Proof, runtime, signal, or public-safe approval. | -| Product front door | [hoxline](https://github.com/HawkinsOperations/hoxline) | Hoxline product experience and Claim Authority capability surface. | Proof authority, runtime truth, signal truth, public-safe approval, or repo expansion approval. | +| Website / Reviewer Guide | [hawkinsoperations.com](https://hawkinsoperations.com/) | Visual walkthrough and presentation of the complete system. | Source, validation, runtime, signal, proof, or public-safe approval. | +| Product / ProofOps control | [hoxline](https://github.com/HawkinsOperations/hoxline) | Hoxline product experience and Claim Authority capability surface. | Proof authority, runtime truth, signal truth, public-safe approval, or repo expansion approval. | | Reviewer start path | [profile/START_HERE.md](../profile/START_HERE.md) | First-click review sequence and claim-boundary reminders. | Stronger claim status than proof records allow. | | Operating cockpit | [private org Control Board route](https://github.com/orgs/HawkinsOperations/projects/2) | Current work visibility and queue coordination for the canonical private HawkinsOperations Control Board; Project #1 is not an active reviewer route. | Source truth, validation truth, runtime truth, signal truth, proof, public-safe status, merge approval, or project metadata authority. | | Proof ledger route | [Lifetime Case Ledger public summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-public-summary.json) | Bounded count summary owned by proof records and platform manifests; this map does not copy changing counts. | Runtime activity, signal observation, public proof, public-safe runtime proof, case closure, or disposition authority. | @@ -62,7 +63,7 @@ Hoxline by HawkinsOperations is the current product/front-door repo and ProofOps | `hawkinsoperations-platform` | Platform architecture, stack truth tracking, and environment boundary documentation. | Detection proof, public proof, sensitive runtime exports, private host details. | Architecture-oriented until runtime evidence is reviewed. | Platform docs prove current deployment state. | | `hawkinsoperations-proof` | Proof contracts, evidence indexes, public-safe records, and claim linkage structure. | Raw private evidence publication, runtime operation, source ownership for other repos. | Proof-oriented only for reviewed and scoped records. | Evidence-linked material is automatically public-safe. | | `hawkinsoperations-website` | Public rendering of approved content. | Source truth, runtime truth, evidence truth, claim approval. | Rendering-oriented after public claim review. | Website presentation proves a claim by itself. | -| `hoxline` | Current Hoxline product/front-door repo and Claim Authority capability UX. | Proof authority, runtime status, signal observation, public-safe approval, or repo expansion. | Product-oriented until proof records approve stronger claims. | A product page or capability label proves a claim by itself. | +| `hoxline` | Current Hoxline product and Claim Authority capability UX. | Proof authority, runtime status, signal observation, public-safe approval, or repo expansion. | Product-oriented until proof records approve stronger claims. | A product page or capability label proves a claim by itself. | ## Cross-Repository Rules diff --git a/architecture/REPRODUCIBLE_REVIEWER_PATH.md b/architecture/REPRODUCIBLE_REVIEWER_PATH.md index a119678..c3a075e 100644 --- a/architecture/REPRODUCIBLE_REVIEWER_PATH.md +++ b/architecture/REPRODUCIBLE_REVIEWER_PATH.md @@ -67,7 +67,7 @@ Read: ```powershell cd ..\hawkinsoperations-detections git status -sb -python .\scripts\verify_detection_contract.py +python -B .\scripts\verify_detection_contract.py ``` Review current detection source and boundaries in: @@ -119,7 +119,7 @@ python -B -m hoxline demo verify --input .hoxline\demo-runs\self-test\run-summar python -B -m hoxline gauntlet verify --input examples\gauntlet\ho-det-001-full-loop-run-v0.json ``` -Hoxline by HawkinsOperations is the product/front-door repo for ProofOps control. The one-command reviewer demo is deterministic, local, and fixture-based; it routes reviewers through the Hoxline loop without publishing private evidence, mutating runtime systems, or promoting public proof. Hoxline governs how AI-assisted security work becomes tested, reviewed, blocked, or safe to claim. Claim Firewall is the first Claim Authority enforcement capability inside Hoxline; it is not the product, platform, front-door repo, an eighth repo, proof authority, runtime proof, or signal proof. +Hoxline by HawkinsOperations is the product and ProofOps control surface. The one-command reviewer demo is deterministic, local, and fixture-based; it routes reviewers through the Hoxline loop without publishing private evidence, mutating runtime systems, or promoting public proof. Hoxline governs how AI-assisted security work becomes tested, reviewed, blocked, or safe to claim. Claim Firewall is the first Claim Authority enforcement capability inside Hoxline; it is not the product, platform, front-door repo, an eighth repo, proof authority, runtime proof, or signal proof. ### Platform Boundary and Visibility Plane ```powershell @@ -142,21 +142,23 @@ Platform output is status/plan visibility unless the relevant proof record and p ```powershell cd ..\hawkinsoperations-proof git status -sb -python scripts\verify_proof_integrity.py +python -B scripts\verify_proof_integrity.py ``` -Expected Phase 1 gap: +Current proof route: -- ID-DET-002, ID-DET-003, and ID-DET-004 proof index entries and proof records are pending. -- HO-DET-012 proof parity is pending if public routing is desired. +- ID-DET-002, ID-DET-003, and ID-DET-004 have proof records and entries in `proof/indexes/DETECTION_PROOF_STATUS_INDEX.yml`, each bounded to its recorded controlled-test scope. +- HO-DET-012 has a proof record, proof card, and indexed `CONTROLLED_TEST_VALIDATED` ceiling; runtime, signal, and public-safe promotion remain separate. ### Website Rendering Plane ```powershell cd ..\hawkinsoperations-website git status -sb -npm install +npm ci +npm run typecheck npm run check:site +npm run public-status:verify npm run build ``` @@ -164,6 +166,7 @@ Expected Phase 1 gap: - ID-DET-002, ID-DET-003, and ID-DET-004 public website routes are pending. - HO-DET-012 appears in current website source data, but proof and website parity remain required before any public proof or public-safe wording can be claimed. +- Inspect the [Website Reviewer Guide](https://hawkinsoperations.com/) in ordinary and presentation modes as rendering QA only; visual success does not promote source, validation, runtime, signal, or proof status. ## Private-Only Commands Excluded @@ -186,7 +189,8 @@ The `.github` command-center route has a local invariant verifier for reviewer-r ```powershell cd .github -python scripts\verify-command-center-invariants.py +$env:PYTHONDONTWRITEBYTECODE = "1" +python -B scripts\verify-command-center-invariants.py ``` Expected output fields: @@ -202,10 +206,10 @@ This verifier proves only that checked command-center route files and invariant | Item | Current routed state | Remaining gap | | --- | --- | --- | -| ID-DET-002 | Source, controlled-test validation, and platform status/plan visibility are documented as carried by PRs #27, #46, and #29. | Proof record/index and website route are pending. | -| ID-DET-003 | Source, controlled-test validation, and platform status/plan visibility are documented as carried by PRs #27, #46, and #29. | Proof record/index and website route are pending. | -| ID-DET-004 | Source, controlled-test validation, and platform status/plan visibility are documented as carried by PRs #27, #46, and #29. | Proof record/index and website route are pending. | -| HO-DET-012 | Source, validation, and platform progress exist. | Proof and website parity are still required if public routing is desired. | +| ID-DET-002 | Source, controlled-test validation, platform visibility, proof record, proof card, and proof-index entry exist in their owning repositories. | Dedicated website presentation routes are not established; current public rendering data requires a separate freshness review. | +| ID-DET-003 | Source, controlled-test validation, platform visibility, proof record, proof card, and proof-index entry exist in their owning repositories. | Dedicated website presentation routes are not established; current public rendering data requires a separate freshness review. | +| ID-DET-004 | Source, controlled-test validation, platform visibility, proof record, proof card, and proof-index entry exist in their owning repositories. | Dedicated website presentation routes are not established; current public rendering data requires a separate freshness review. | +| HO-DET-012 | Source, controlled validation, platform controls, proof record, proof card, and bounded website summary exist. | Runtime, signal, and public-safe promotion remain separately gated. | | Cross-repo parity | Report-only scanner exists in validation. | Fail-closed promotion requires separate approval. | ## Claim Boundary diff --git a/governance/COMMAND_CENTER_INVARIANTS.json b/governance/COMMAND_CENTER_INVARIANTS.json index dbcb12d..847ce25 100644 --- a/governance/COMMAND_CENTER_INVARIANTS.json +++ b/governance/COMMAND_CENTER_INVARIANTS.json @@ -1,6 +1,15 @@ { "schema": "hawkinsoperations-command-center-invariants-v1", "scope": "HawkinsOperations/.github reviewer routing and governance shell", + "system_repositories": [ + ".github", + "hoxline", + "hawkinsoperations-detections", + "hawkinsoperations-validation", + "hawkinsoperations-platform", + "hawkinsoperations-proof", + "hawkinsoperations-website" + ], "required_route_files": [ "README.md", "profile/README.md", @@ -17,6 +26,9 @@ ], "invariants": { "github_repo_role": ".github is reviewer routing and governance shell only", + "presentation_route": "hawkinsoperations.com is the Website Reviewer Guide and presentation surface", + "seven_repository_authority": "HawkinsOperations has exactly seven system repositories with separate authority roles", + "hoxline_role": "Hoxline is the product and ProofOps control surface, not proof authority", "project_2_role": "Project #2 is the canonical private HawkinsOperations Control Board operating cockpit", "project_1_boundary": "Project #1 is not an active reviewer route", "project_metadata_boundary": "Project metadata is coordination only, not proof, approval, merge authority, runtime truth, signal truth, or public-safe status", diff --git a/governance/CONTROL_STATUS_MATRIX.md b/governance/CONTROL_STATUS_MATRIX.md index b573a02..49c6ef4 100644 --- a/governance/CONTROL_STATUS_MATRIX.md +++ b/governance/CONTROL_STATUS_MATRIX.md @@ -24,7 +24,7 @@ A control is REAL_CONTROL only when it blocks, fails, or forces correction throu | HO-DET-001 platform runtime contract enforcement | `hawkinsoperations-platform` | SATISFIED | CONTROLLED_TEST_VALIDATED | Yes, only as a contract/verifier guardrail | `HawkinsOperations/hawkinsoperations-platform#5`; merge commit `b3d0ffbd66c1bd5f60f7e9ff99712cdc3e0595bd`; `contracts/examples/ho-det-001-runtime-contract.sample.json`; `scripts/verify-ho-det-001-runtime-contract.py` | "HO-DET-001 platform runtime contract enforcement exists as a non-promotional guardrail." | "Platform contract enforcement proves runtime-active, signal-observed public proof, public-safe runtime proof, live Splunk fired, Splunk-proven Runtime Signal 001, Cribl-routed, Wazuh-routed public proof, AWS-live, production-ready, fleet-wide, autonomous SOC, AI-approved disposition, or analyst-approved disposition." | Runtime/signal/public-safe evidence review remains separate. | | HO-DET-001 proof integrity gate | `hawkinsoperations-proof` | SATISFIED | CONTROLLED_TEST_VALIDATED | Yes, only for HO-DET-001 proof-record integrity, required proof fields, linked artifacts, validation facts, blocked-claim context, and private-leak boundary checks | `HawkinsOperations/hawkinsoperations-proof#13`; merge commit `23f4fb8fd48994307bd07030a3713cb184639a88`; `.github/workflows/ho-det-001-proof-integrity.yml`; `scripts/verify-ho-det-001-proof-integrity.py` | "HO-DET-001 proof integrity gate exists for the exact checked proof-record boundary scope." | "Proof integrity gate proves runtime-active, signal-observed public proof, public-safe runtime proof, production-ready, fleet-wide, live Splunk fired, Splunk-proven Runtime Signal 001, Cribl-routed, Wazuh-routed public proof, AWS-live, autonomous SOC, AI-approved disposition, or analyst-approved disposition." | Repository ruleset or required-check enforcement if Raylee wants this proof gate to become merge-blocking on main. | | HO-DET-001 private runtime boundary context | `hawkinsoperations-proof` / `hawkinsoperations-validation` | PRIVATE_INTERNAL_BOUNDARY_CONTEXT | CONTROLLED_TEST_VALIDATED public ceiling; NOT_PUBLIC_SAFE public-safe status | Yes, only through deterministic private-packet verifier and proof-record review; not public-safe raw proof | [validation PR #22](https://github.com/HawkinsOperations/hawkinsoperations-validation/pull/22); [proof PR #14](https://github.com/HawkinsOperations/hawkinsoperations-proof/pull/14); [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) | "HO-DET-001 private/internal runtime material is non-public boundary context." | "Public-safe runtime proof"; "runtime-active deployment"; "signal-observed public proof"; raw command lines; encoded payloads; LAN IPs; local artifact paths; raw CSV names; screenshots as public evidence. | Public-safe promotion remains blocked pending reviewed wording, privacy review, stale review, evidence linkage review, and Raylee approval. | -| Lifetime Case Ledger public summary | `hawkinsoperations-proof` | BOUNDED_COUNT_ROUTE | SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY; NOT_PUBLIC_SAFE ledger status | Yes, only for proof-owned summary/bundle schema consistency when verifier jobs pass | [public summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-public-summary.json); [proof bundle](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-proof-bundle.json); `lifetime-ledger-public-summary`; `lifetime-ledger-proof-bundle` | "The proof-owned ledger summary records 4 ledger events, 4 cases, 0 public-safe cases, 0 closed cases, and appended detections HO-DET-001, HO-DET-011, and HO-DET-012." | "Ledger counts prove runtime activity, signal observation, public proof, public-safe runtime proof, production deployment, SOCaaS availability, autonomous SOC authority, AI-approved final disposition, analyst-approved final disposition, or case closure authority." | Public-safe promotion, runtime/signal evidence review, and closure/disposition authority remain separate gates. | +| Lifetime Case Ledger public summary | `hawkinsoperations-proof` | BOUNDED_COUNT_ROUTE | SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY; NOT_PUBLIC_SAFE ledger status | Yes, only for proof-owned summary/bundle schema consistency when verifier jobs pass | [current platform state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json); [historical proof summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-public-summary.json); [proof bundle](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-proof-bundle.json) | "Current ledger values are read from the platform-owned state manifest; proof summaries may preserve bounded historical snapshots." | "Ledger values prove runtime activity, signal observation, public proof, public-safe runtime proof, production deployment, SOCaaS availability, autonomous SOC authority, AI-approved final disposition, analyst-approved final disposition, or case closure authority." | Public-safe promotion, runtime/signal evidence review, and closure/disposition authority remain separate gates. | | HO-DET-001 public runtime-active | `hawkinsoperations-proof` | BLOCKED | NOT_PUBLIC_SAFE | No | No public-safe runtime deployment evidence approved | "Runtime-active status remains blocked on public surfaces." | "HO-DET-001 is active in production." | Approved deployment evidence and public claim review. | | HO-DET-001 public signal-observed | `hawkinsoperations-proof` | BLOCKED | NOT_PUBLIC_SAFE | No | No public-safe signal evidence approved | "Signal-observed status remains blocked on public surfaces unless separately scoped and approved as non-public boundary context." | "HO-DET-001 has public signal proof." | Evidence linkage, privacy review, stale review, and Raylee approval. | | HO-DET-001 public evidence linkage | `hawkinsoperations-proof` | BLOCKED | NOT_PUBLIC_SAFE | No | No public-safe evidence linkage approved | "Evidence-linked public proof remains blocked." | "HO-DET-001 public proof is complete." | Public-safe evidence linkage review and approval. | @@ -45,7 +45,7 @@ HO-DET-001 proof integrity enforcement exists through `HawkinsOperations/hawkins HO-DET-001 has private/internal runtime boundary context through validation PR [#22](https://github.com/HawkinsOperations/hawkinsoperations-validation/pull/22), proof PR [#14](https://github.com/HawkinsOperations/hawkinsoperations-proof/pull/14), and the [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md). The public ceiling remains CONTROLLED_TEST_VALIDATED and the public-safe status remains NOT_PUBLIC_SAFE. -The proof-owned Lifetime Case Ledger public summary records 4 ledger events, 4 total cases, 0 public-safe cases, and 0 closed cases. Its ledger status remains NOT_PUBLIC_SAFE, and the front-door/status proof ceiling remains SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY. +Current Lifetime Case Ledger values must be read from the platform-owned [`lifetime-case-ledger-v1-state-manifest.json`](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json). Proof-owned reviewer summaries may preserve historical point-in-time snapshots; this matrix does not copy those changing counts. The ledger status remains NOT_PUBLIC_SAFE, and the front-door/status proof ceiling remains SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY. The public ceiling remains CONTROLLED_TEST_VALIDATED. Public-safe status remains NOT_PUBLIC_SAFE. Public runtime-active, public signal-observed, public evidence-linked, and public-safe claims remain blocked until reviewed wording, privacy review, stale review, evidence linkage review, and Raylee approval are complete. diff --git a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md index 19eefc7..f165537 100644 --- a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md +++ b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md @@ -67,9 +67,9 @@ These notes are recorded for Phase 1 routing. They do not promote any repository - Detections PR #27 carried ID-DET-002, ID-DET-003, and ID-DET-004 source. - Validation PR #46 carried ID-DET-002, ID-DET-003, and ID-DET-004 controlled-test validation. - Platform PR #29 carried ID-DET-002, ID-DET-003, and ID-DET-004 status/plan visibility. -- Proof index and proof records for ID-DET-002, ID-DET-003, and ID-DET-004 are pending. +- Proof records, proof cards, and proof-index entries now exist for ID-DET-002, ID-DET-003, and ID-DET-004, each bounded to its recorded controlled-test ceiling. - Website public routes for ID-DET-002, ID-DET-003, and ID-DET-004 are pending. -- HO-DET-012 has source, validation, and platform progress, but still needs proof and website parity if public routing is desired. +- HO-DET-012 has source, controlled validation, platform controls, a proof record, a proof card, and bounded website summary; runtime, signal, and public-safe promotion remain separately gated. - Cross-repo parity is report-only unless later promoted to fail-closed under separate approval. ## Phase 2A Validation Enforcement diff --git a/profile/README.md b/profile/README.md index b7ec8c7..f346875 100644 --- a/profile/README.md +++ b/profile/README.md @@ -1,378 +1,134 @@

- HawkinsOperations — AI Security Operations banner + HawkinsOperations — governed AI Security Operations

# HawkinsOperations -**HawkinsOperations is a governed AI Security Operations and detection engineering system. AI accelerates drafting, triage reasoning, case-packet support, documentation, and automation planning; deterministic validation, proof records, and human review decide what becomes operational truth.** +**A governed AI Security Operations and detection engineering system for turning AI-assisted security work into bounded, inspectable artifacts.** -`CONTROLLED_TEST_VALIDATED` · `HO-DET-001` · `NOT_PUBLIC_SAFE` · `RENDERING_NOT_PROOF` · `HUMAN_REVIEW_REQUIRED` - -[Start Here](START_HERE.md) · [Hoxline](https://github.com/HawkinsOperations/hoxline) · [Public Control Board](https://github.com/orgs/HawkinsOperations/projects/3) · [proof repo](https://github.com/HawkinsOperations/hawkinsoperations-proof) · [validation repo](https://github.com/HawkinsOperations/hawkinsoperations-validation) · [detections repo](https://github.com/HawkinsOperations/hawkinsoperations-detections) · [website](https://hawkinsoperations.com/) · [HO-DET-001 proof route](https://hawkinsoperations.com/proof/ho-det-001/) +AI produces labor. Evidence and human review authorize claims.
--- -## What this is - -HawkinsOperations is a governed AI Security Operations and detection engineering system that turns detection work into source-controlled rules, deterministic validation, platform contracts, proof records, reviewer releases, runtime candidate lanes, and human-governed promotion gates. - -AI accelerates drafting, triage reasoning, case-packet support, documentation, and automation planning. Validation, platform guardrails, proof records, and human review decide what becomes operational truth. - -## Product: Hoxline by HawkinsOperations - -Hoxline by HawkinsOperations is the current product/front-door repo for ProofOps control. - -- Product route: https://hawkinsoperations.com/hoxline/ -- Current repository path: https://github.com/HawkinsOperations/hoxline -- Tagline: ProofOps control for the AI security era. -- One-liner: Hoxline governs how AI-assisted security work becomes tested, reviewed, blocked, or safe to claim. -- Compatibility note: AevumGuard was a prior working name. Hoxline is the current product name. -- Doctrine: AI is not the authority. Evidence is. -- Proof ceiling: public routing clarity only; no proof promotion. - -Hoxline separates AI output from evidence-bound claim authority. Claim Authority governs what can be claimed. Claim Firewall is the first Claim Authority enforcement capability inside Hoxline and blocks unsupported claims by checking configured wording policy only. ProofCards export the evidence boundary behind an approved claim. - -Claim Firewall is not the product, platform, front-door repo, an eighth repo, proof authority, runtime proof, or signal proof. It does not prove detection behavior, runtime telemetry, signal observation, production deployment, public release approval, service availability, customer rollout, AI approval, analyst approval, or final human authorization. - -## Current status sources - -Current pipeline and ledger values live in their owning repositories and records. This org README links to those sources instead of copying changing counts into a public rendering surface. - -| Status area | Authoritative source | Boundary | -|---|---|---| -| Platform ledger state | [Platform ledger state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) | Platform owns ledger mechanics and state manifests; this profile does not create ledger truth. | -| Reviewer metrics pipeline | [Reviewer metrics summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/reviewer-metrics-pipeline-v1-summary.json) | Reviewer-scale activity does not become governed case truth, runtime truth, signal truth, or public-safe proof by being rendered here. | -| Proof records and claim ceilings | [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof) | Proof records authorize only their stated scope; this profile routes reviewers and preserves boundaries. | -| Control status wording | [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md) | Status wording is a routing aid, not proof authority or public-safe approval. | - -## Standout receipts - -| Receipt | What exists | Why it matters | -|---|---|---| -| [HO-DET-001 proof path](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) | PowerShell EncodedCommand detection route mapped to ATT&CK T1059.001, with detection source, Splunk source, controlled validation, proof record, and public route. | Shows the full source -> validation -> platform contract -> proof -> rendering chain for one concrete detection. | -| [Proof Pack 001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) | Bounded reviewer release ZIP with SHA256 and verifier route for HO-DET-001. | Gives a reviewer one package to verify without private lab access. | -| [Runtime Route Proof v1](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/maps/RUNTIME-ROUTE-PROOF-V1-REVIEWER-MAP.md) | Private-candidate Wazuh -> Cribl -> Splunk route summary and prerelease. | Preserves a runtime-route proof candidate without publishing raw private evidence or raising public proof status. | -| [Reviewer metrics summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/reviewer-metrics-pipeline-v1-summary.json) | Reviewer Metrics Pipeline v1 closeout snapshot and source record. | Reports reviewer-scale activity without turning validation activity into governed case truth. | -| [Seven-repo authority model](../architecture/REPO_AUTHORITY_MAP.md) | Detections own source, validation owns behavior, platform owns mechanics, proof owns claim ceilings, website renders, `.github` routes, and `hoxline` is the current product/front-door repo. | Makes the system reviewable without allowing one repo or page to claim another truth surface. | - -## Authority engines +## Choose the right door -| Engine | What it owns | Why it matters | +| If you want to... | Start here | What that surface does | |---|---|---| -| Detections | Source truth | Detection logic and metadata stay source-controlled and reviewable. | -| Validation | Behavior truth | Controlled cases, parity checks, case packets, AI-boundary checks, and runner trust split prove behavior inside scope. | -| Platform | Control mechanics | Contracts, schemas, factory commands, ledgers, append gates, runtime candidate lanes, and verifier guardrails make the operating model executable. | -| Proof | Claim authority | Proof records, claim ceilings, proof packs, reviewer maps, blocked claims, and releases decide what can be claimed. | -| Website | Rendering | Public cockpit and reviewer routes; rendering does not create proof authority. | -| `.github` | Command center | Org front door, reviewer routing, command-center boundaries, and authority explanation. | - -**Platform is the mechanical control layer.** It turns detection work into governed, machine-checkable workflow through contracts, factory commands, ledger mechanics, case-packet schemas, runtime candidate gates, reviewer metrics state, and verifier scripts. Platform does not own proof promotion or public-safe runtime truth. - -**Validation is the behavior engine.** It turns detection claims into reproducible checks through controlled cases, local case pipeline, registry checks, activity ledger, parity checks, blocked-claim scans, AI authority boundaries, and runner trust separation. Validation does not prove live runtime, signal-observed public proof, or production deployment. +| Understand or present the complete system | **[Website / Reviewer Guide](https://hawkinsoperations.com/)** · [enter presentation mode](https://hawkinsoperations.com/?present=1&scene=1) | Visual walkthrough for a podcast, brown bag, show-and-tell, technical review, or self-guided inspection. Website rendering is not proof. | +| Explore the product | **[Hoxline](https://hawkinsoperations.com/hoxline/)** | ProofOps control for the AI security era: how AI-assisted work becomes tested, reviewed, blocked, or safe to claim. | +| Verify source and receipts | **[GitHub reviewer route](START_HERE.md)** | Source, deterministic validation, proof records, contracts, governance, and reproducible checks across seven authority repositories. GitHub rendering is not proof. | -**Proof is the public trust anchor.** It owns proof records, claim ceilings, Proof Pack 001, Runtime Route Proof v1, reviewer maps, release routes, and proof-boundary case studies. Proof records authorize only their stated scope. +The three surfaces work together without sharing authority: the website explains, Hoxline controls the review path, and GitHub exposes the source and receipts. -## What this does not claim - -Runtime-active public proof, signal-observed public proof, public-safe runtime proof, production SOC, production SOCaaS, customer deployment, live enterprise deployment, autonomous SOC, AI-decided disposition, AI-approved disposition, analyst-approved disposition, case closure, FortiSIEM integration proven, fleet-wide coverage, public-safe Runtime Route Proof v1, Wazuh/Cribl/Splunk public proof, broad ingestion proof, website/GitHub rendering as proof, GitHub Project metadata as proof, and green CI as approval are not claimed here. - -## HawkinsOperations Control Panel - -`.github` is the org command center for reviewer routing, truth boundaries, and claim controls. It does not create proof authority. Proof records live in [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof), and the current public ceiling remains `CONTROLLED_TEST_VALIDATED` unless a specific proof record says otherwise. Runtime, signal, public-safe, production, SOCaaS, autonomous SOC, AI-approved disposition, and analyst-approved disposition claims remain blocked unless explicitly proven and approved. - -Public Control Board: A public-safe project board showing Built, Proven, Blocked, Deferred, and Review Path states. It is a routing/status snapshot only. It does not mirror the private Control Board and does not create proof, runtime truth, signal truth, public-safe approval, or merge authority. - -| Command center view | Current route | Boundary | -|---|---|---| -| Seven-repo architecture | [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) | Repos own separate truth surfaces; no repo may claim another repo's authority. No eighth repo may be added without explicit approval. | -| Proof chain | Detection source -> validation -> case packet -> proof record -> public rendering | Public rendering routes reviewers; it does not create proof. | -| Truth surfaces | [Six truth surfaces](#six-truth-surfaces) | Source, validation, runtime, signal, evidence, and public rendering stay separate. | -| Front-door/status proof ceiling | `SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY` | Applies to command-center and ledger-status routing; HO-DET-001 proof records keep their own proof ceiling. | -| Current ledger status | [Platform ledger state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) | Platform-owned manifest is authoritative for current ledger state; this profile does not copy ledger counts or create public-safe status. | -| Public Control Board | [HawkinsOperations Public Control Board](https://github.com/orgs/HawkinsOperations/projects/3) | Public-safe Built / Proven / Blocked / Deferred / Review Path snapshot; not private Project, not proof authority, not runtime/signal/public-safe approval. | -| Project operating cockpit | [private org Control Board route](https://github.com/orgs/HawkinsOperations/projects/2) | Canonical private HawkinsOperations Control Board; Project #1 is not an active reviewer route; project metadata is not proof, approval, runtime, signal, public-safe status, or merge authority. | -| Reviewer/demo path | [Start Here 30-second path](START_HERE.md#30-second-reviewer-path) and [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) | Demo routing does not raise the claim ceiling. | -| Command-center invariant check | [`python scripts/verify-command-center-invariants.py`](../scripts/verify-command-center-invariants.py) | Verifier control for route and claim-boundary invariants; it does not create runtime, signal, public-safe, or proof authority. | - -| Reviewer need | Route | -|---|---| -| Start the review | [Start Here](START_HERE.md) | -| See repo authority boundaries | [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) | -| Check control status wording | [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md) | -| Inspect standing controls | [Standing control registers](../governance/ISSUE_FACTORY_CONTROL_RECEIPTS.md) | -| Inspect proof records | [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof) | -| Inspect validators and case packets | [hawkinsoperations-validation](https://github.com/HawkinsOperations/hawkinsoperations-validation) | -| Inspect detection source | [hawkinsoperations-detections](https://github.com/HawkinsOperations/hawkinsoperations-detections) | -| Inspect platform contracts | [hawkinsoperations-platform](https://github.com/HawkinsOperations/hawkinsoperations-platform) | -| Inspect public rendering | [hawkinsoperations-website](https://github.com/HawkinsOperations/hawkinsoperations-website) | - -The private Control Board supports internal governance and navigation. It is not proof, not public evidence, and not a public-safe approval surface. - -The private org Control Board is the private Project #2 operating cockpit for current work visibility. Project #1 is not an active reviewer route and was not resolvable through the live ProjectV2 API during the current cleanup pass. The board is useful for navigation, queue review, and sprint context only; it does not mutate proof state, authorize merge, approve public wording, or promote public-safe status. - ---- +Hoxline doctrine: AI is not the authority. Evidence is. ## Fast reviewer paths -| Time | Route | Boundary | +| Time | Route | Outcome | |---:|---|---| -| 30 sec | Open [Start Here](START_HERE.md), then [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md). | Confirms the command center, current ceiling, and blocked claims. | -| 3 min | Follow [Start Here](START_HERE.md) through Project #2, repo authority, standing controls, and the HO-DET-001 proof record. | Project metadata remains coordination-only. Proof stays in `hawkinsoperations-proof`. | -| 10 min | Run the [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) and the command-center invariant verifier. | Clone-runnable inspection and invariant checks only; no private runtime access or proof promotion. | +| **30 seconds** | [Open the Reviewer Guide](https://hawkinsoperations.com/) → [open Hoxline](https://hawkinsoperations.com/hoxline/) → [inspect HO-DET-001 proof](https://hawkinsoperations.com/proof/ho-det-001/) | Understand the system, the product control surface, and one bounded proof route. | +| **3 minutes** | Follow [source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001) → [controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md) → [proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) → [Claim Firewall](https://hawkinsoperations.com/claim-firewall/) | See how one detection moves through separate truth surfaces while unsupported wording stays blocked. | +| **10 minutes** | Use the [focused runnable path](START_HERE.md#10-minute-reviewer-path) | Run Hoxline's local fixture-based demo, then inspect the HO-DET-001 source, validation, proof, and claim boundary. | +| **Extended** | Use the [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) | Clone all seven repositories and run their public checks without private runtime access. | ---- - -## The enterprise AI failure mode - -AI can accelerate security work. It cannot authorize the truth. - -Without a control system, AI-generated output becomes a public claim, an analyst conclusion, an operational action, a security disposition, and an executive truth — before any evidence or human review ever authorized it. +## The system in one route ```text - AI OUTPUT - │ - ▼ - UNVERIFIED CLAIM - │ - ▼ - OPERATIONAL ACTION - │ - ▼ - SECURITY DISPOSITION - │ - ▼ - EXECUTIVE TRUTH ✕ BLOCKED ✕ +AI-assisted labor + ↓ +Source-controlled security work + ↓ +Deterministic validation + ↓ +Hoxline and Claim Authority + ↓ +Evidence and proof artifacts + ↓ +Human review + ↓ +Bounded public output ``` -This is the failure mode HawkinsOperations is built to prevent. - ---- - -## The HawkinsOperations control route - -AI labor enters the system. Source, validation, deterministic verification, evidence records, proof records, and human review stand between labor and any public claim. - -```text - AI LABOR - │ scoped: drafts, scaffolds, summaries — never authorization - ▼ - SOURCE hawkinsoperations-detections - │ - ▼ - CONTROLLED VALIDATION hawkinsoperations-validation - │ - ▼ - DETERMINISTIC VERIFIER fixtures · checks · CI gates - │ - ▼ - EVIDENCE RECORD bounded, scoped, reviewable - │ - ▼ - PROOF RECORD hawkinsoperations-proof - │ - ▼ - HUMAN REVIEW required · not delegable to AI - │ - ▼ - PUBLIC BOUNDARY hawkinsoperations.com · .github -``` - -**AI generates work. Evidence and human review authorize claims.** - ---- - -## Proof Pack 001 — released - - - - - - -
- -**HO-DET-001 reviewer release package** +AI may accelerate drafting, detection logic, query translation, summarization, enrichment, reviewer notes, documentation, and repetitive implementation. AI does not decide evidence sufficiency, disposition, approval, merge, claim promotion, public-safe status, production status, or case closure. -The official, bounded reviewer route for the HO-DET-001 detection: source, validation, case packet, proof record, and the public boundary — packaged as one bounded reviewer ZIP and one GitHub Release. +## Seven repositories, seven authority roles -- Release: [hawkinsoperations-proof-pack-001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) -- Discussion: [HawkinsOperations Proof Pack 001 Released](https://github.com/orgs/HawkinsOperations/discussions/32) -- Asset: `HAWKINSOPERATIONS_PROOF_PACK_001.zip` -- ZIP SHA256: `44d8a643aa2b113c9e99be0462e699d39af707a67190823cc05bb381907dc452` - - - -**What this release is** - -| Field | Value | -|---|---| -| Public proof ceiling | `CONTROLLED_TEST_VALIDATED` | -| Reviewer package status | `BOUNDED_REVIEWER_RELEASE_CANDIDATE` | -| Raw/private runtime evidence | `NOT_PUBLIC_SAFE` | -| Public-safe runtime proof | `BLOCKED` | -| Rendering of this page | `RENDERING_NOT_PROOF` | - -
- -**What this release does not prove.** It is a reviewer route and a bounded ZIP. It does not promote runtime-active public proof, signal-observed public proof, public-safe runtime proof, production readiness, SOCaaS, autonomous SOC, AI-approved disposition, or analyst-approved disposition. Website/GitHub rendering is not proof. - ---- - -## Current ledger status - -The platform-owned [Lifetime Case Ledger state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) is the authoritative source for current strict governed ledger state. This org README does not copy ledger event counts, case totals, public-safe counts, or closure counts into a public rendering surface. - -| Ledger field | Current source-controlled value | -|---|---| -| Ledger state | See the platform ledger state manifest. | -| Ledger counts | See the platform ledger state manifest. | -| Appended detections | `HO-DET-001`, `HO-DET-011`, `HO-DET-012` | -| Ledger public-safe status | `NOT_PUBLIC_SAFE` | -| Ledger proof ceiling | `SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY` | - -Runtime Case Collector v0 has separate private candidate lanes. Their current candidate and append state is governed by platform-owned manifests, records, and verifier gates, not by copied counts in this profile. - -This ledger route does not prove runtime activity, signal observation, production deployment, SOCaaS availability, public-safe runtime proof, public proof, autonomous SOC authority, AI-approved final disposition, analyst-approved final disposition, or case closure authority. - ---- - -## Reviewer routes - -Pick the route that matches your review job. The route changes how you inspect the system; it does not change the proof state. - -| Route | Time | What you inspect | Start here | -|---|---:|---|---| -| Hiring manager | 3 min | What the system is, what is proven, what stays blocked. | [Start Here](START_HERE.md) | -| Detection engineer | 10 min | Detection source, validation scope, HO-DET-001 path. | [detections repo](https://github.com/HawkinsOperations/hawkinsoperations-detections) | -| SOC automation lead | 10 min | Case packet flow, deterministic checks, CI boundaries, runtime-contract separation. | [validation repo](https://github.com/HawkinsOperations/hawkinsoperations-validation) | -| AI governance reviewer | 10 min | Where AI supports labor and where human review authorizes claims. | [proof repo](https://github.com/HawkinsOperations/hawkinsoperations-proof) | -| Demo reviewer | 8 min | Command-center route, project cockpit, Proof Pack 001, and reproducible reviewer path. | [Start Here](START_HERE.md) | -| Cyber Kill Chain reviewer | 10 min | Attack-lifecycle coverage map across source, validation, proof, platform contracts, and blocked claims. | [Cyber Kill Chain coverage map](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/docs/mappings/CYBER_KILL_CHAIN_COVERAGE.md) | -| Public rendering reviewer | 2 min | Public presentation and reviewer navigation only; rendering does not create proof. | [HO-DET-001 proof route](https://hawkinsoperations.com/proof/ho-det-001/) | - ---- - -Org-level reviewer entry point: Cyber Kill Chain coverage lives in `hawkinsoperations-proof` as a public route-safe reviewer map. It is not public-safe approval, runtime proof, or proof authority. - -## Six truth surfaces - -Each surface supports its own claims, nothing more. Authority does not flow between them by presentation. - -| Surface | Supports | Does not assert | +| Repository | Authority role | Does not own | |---|---|---| -| Source truth | A source artifact exists and can be reviewed. | Deployment, runtime behavior, signal observation, or public proof. | -| Validation truth | A deterministic validation process passed inside its stated scope. | Runtime operation, public signal, or external-use authorization. | -| Runtime truth | A control or detection is active in a runtime environment when runtime evidence is reviewed. | Signal observation, evidence linkage, or public-safe proof. | -| Signal truth | A bounded signal was observed in a stated context when signal evidence is reviewed. | Fleet scope, production readiness, or public-safe status. | -| Evidence truth | A preserved artifact supports a specific bounded claim. | Claims outside the evidence boundary. | -| Public rendering | Website and GitHub presentation of reviewed routes and wording. | Proof of any kind. | - -```mermaid -flowchart LR - A[Source] --> B[Validation] - B --> C[Case packet] - C --> D[Proof record] - D --> E[Public boundary] - F[AI support] -. labor only .-> A - F -. labor only .-> B - G[Human review] --> D - H[Deterministic checks] --> D - E -. rendering is not proof .-> I[Website / GitHub] -``` - ---- - -## Repository authority map +| [`.github`](https://github.com/HawkinsOperations/.github) | Organization routing and governance shell | Proof, runtime, signal, or merge authority | +| [`hoxline`](https://github.com/HawkinsOperations/hoxline) | Product and ProofOps control surface | Proof records, runtime proof, or final approval | +| [`hawkinsoperations-detections`](https://github.com/HawkinsOperations/hawkinsoperations-detections) | Detection source truth | Validation, runtime, signal, or proof truth | +| [`hawkinsoperations-validation`](https://github.com/HawkinsOperations/hawkinsoperations-validation) | Controlled validation truth | Live runtime, signal, production, or disposition truth | +| [`hawkinsoperations-platform`](https://github.com/HawkinsOperations/hawkinsoperations-platform) | Contracts and control mechanics | Proof promotion or final human authority | +| [`hawkinsoperations-proof`](https://github.com/HawkinsOperations/hawkinsoperations-proof) | Evidence records and claim ceilings | Broader claims than its records support | +| [`hawkinsoperations-website`](https://github.com/HawkinsOperations/hawkinsoperations-website) | Public rendering and presentation | Source, validation, runtime, signal, or proof authority | -Seven repositories. Three planes. Authority flows through scoped records, not presentation. The current product/front-door repository is `hoxline`. +See the [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) for the complete ownership contract. No eighth system repository is created or implied here. -| Plane | Repository | Authority | Boundary | -|---|---|---|---| -| Governance / routing | `.github` | Organization profile, reviewer routing, control summaries. | Routes reviewers; does not prove source, runtime, signal, evidence, or public proof. | -| Authority chain | [`hawkinsoperations-detections`](https://github.com/HawkinsOperations/hawkinsoperations-detections) | Detection source logic and ownership trail. | Source does not prove validation or runtime. | -| Authority chain | [`hawkinsoperations-validation`](https://github.com/HawkinsOperations/hawkinsoperations-validation) | Fixtures, validators, case packets, deterministic checks. | Validation does not prove public runtime or signal state. | -| Internal / private runtime contract | `hawkinsoperations-platform` | Runtime contracts, interface boundaries, non-promotional guardrails. | Internal/private runtime-contract route; not a public proof route and not public proof. | -| Authority chain | [`hawkinsoperations-proof`](https://github.com/HawkinsOperations/hawkinsoperations-proof) | Proof records, claim ceilings, evidence boundary records, cited case packets. | Proof records do not publish private evidence or raise ceilings by presentation. | -| Rendering | [`hawkinsoperations-website`](https://hawkinsoperations.com/) | Public reviewer navigation and rendered wording. | Rendering is not proof and cannot approve a claim. | -| Product / front door | [`hoxline`](https://github.com/HawkinsOperations/hoxline) | Current Hoxline product/front-door repo and ProofOps control surface. Claim Firewall is its first internal Claim Authority enforcement capability. | Product framing does not create proof authority, runtime truth, signal truth, public-safe status, or approval. | +## One concrete receipt: HO-DET-001 -Detections → validation → proof feeds the authority chain. `.github` routes reviewers. `hawkinsoperations-platform` remains an internal/private runtime-contract route. `hoxline` is the current Hoxline product/front-door repo. AevumGuard was a prior working name. Hoxline is the current product name. The website renders receipts; it does not author them. +HO-DET-001 is a PowerShell EncodedCommand detection example. It is useful because a reviewer can inspect each handoff separately: ---- - -## Hoxline Claim Authority - -Claim Authority governs what can be claimed. Claim Firewall blocks unsupported claims before public wording ships. Blocked terms stay listed because they describe what this surface does not assert. +1. [Detection source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001) records the rule, query, metadata, and event-field expectations. +2. [Controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md) checks expected matches and known non-matches with deterministic fixtures. +3. [Proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) states the supported claim and the evidence ceiling. +4. [Proof Pack 001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) packages a bounded reviewer route with a verifier and release receipt. +5. [Website proof route](https://hawkinsoperations.com/proof/ho-det-001/) renders the reviewed boundary and routes back to its owners. -Blocked unless separately promoted and approved: +The current public ceiling for this example is `CONTROLLED_TEST_VALIDATED`. Controlled validation is evidence for the tested fixture scope; it is not automatic production truth. -`public-safe` · `production-ready` · `fleet-wide` · `live enterprise deployment` · `autonomous SOC` · `AI-approved disposition` · `analyst-approved disposition` · `runtime-active public proof` · `signal-observed public proof` · `evidence-linked public proof` · `live Splunk public proof` · `Cribl-routed public proof` · `Wazuh-routed public proof` · `AWS-live proof` · `customer-ready product` · `sold product` · `enterprise deployment` +## Evidence boundary -Allowed public boundary for this profile: +The truth surfaces may reference one another, but they are not interchangeable: -| Field | Current value | +| Surface | What it can establish | |---|---| -| Flagship path | `HO-DET-001` | -| Public proof ceiling | `CONTROLLED_TEST_VALIDATED` | -| Public-safe status | `NOT_PUBLIC_SAFE` | -| Surface mode | `RENDERING_NOT_PROOF` | -| Promotion authority | `HUMAN_REVIEW_REQUIRED` | -| Runtime-active public proof | `BLOCKED` | -| Signal-observed public proof | `BLOCKED` | -| Evidence-linked public proof | `BLOCKED` | -| Production / fleet / autonomous claim | `BLOCKED` | +| Repository source | A source-controlled artifact exists. | +| Controlled validation | The checked behavior passed within the stated fixture scope. | +| Runtime | Requires runtime-owned evidence. | +| Signal | Requires observed telemetry and an authorized evidence route. | +| Proof record | Authorizes only its stated claim ceiling. | +| Public rendering | Helps a reviewer navigate; it does not create proof. | ---- - -## HO-DET-001 — flagship proof path +`CONTROLLED_TEST_VALIDATED`, `NOT_PUBLIC_SAFE`, and `SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY` describe different bounded surfaces. They must not be combined into a stronger claim. -HO-DET-001 is the artifact reviewers can trace end to end without accepting a stronger public claim. +Runtime-active public proof, signal-observed public proof, production deployment, customer deployment, fleet-wide coverage, SOCaaS operation, autonomous SOC behavior, AI-approved disposition, analyst-approved disposition, public-safe runtime evidence, and case closure are not established here. -| Receipt | Review route | What it supports | -|---|---|---| -| Source | [Detection source repo](https://github.com/HawkinsOperations/hawkinsoperations-detections) | The detection source exists under version control. | -| Validation | [Validation repo](https://github.com/HawkinsOperations/hawkinsoperations-validation) | Controlled positive and negative test scope can be inspected. | -| Case packet | [Validation repo](https://github.com/HawkinsOperations/hawkinsoperations-validation) and [Proof repo](https://github.com/HawkinsOperations/hawkinsoperations-proof) | Case packets are produced/validated in validation and cited/recorded by proof. | -| Proof record | [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) | The current public ceiling and blocked claims are recorded. | -| Public rendering | [HO-DET-001 public route](https://hawkinsoperations.com/proof/ho-det-001/) | Reviewer navigation only; rendering does not create proof. | +Website/GitHub rendering is not proof. Green CI is not merge authority. Human review remains mandatory. -Public proof ceiling remains `CONTROLLED_TEST_VALIDATED`. Public-safe status remains `NOT_PUBLIC_SAFE`. +## Deeper inspection ---- - -## Prior operating context - -HawkinsOps V1 / SignalFoundry metrics are prior operating context only. They are not current HawkinsOperations proof and do not raise the current HawkinsOperations ceiling. - -| Prior context | Boundary | +| Reviewer need | Owner route | |---|---| -| 324,074 cases processed | Historical V1 / HawkinsOps context only. | -| 200+ detections built | Historical V1 / HawkinsOps context only. | -| 208/208 CI assertions | Historical V1 / HawkinsOps context only. | -| 39.7% reduction measured | Historical V1 / HawkinsOps context only. | -| 100% high-severity preservation | Historical V1 / HawkinsOps context only. | +| Understand the full system | [Website Reviewer Guide](https://hawkinsoperations.com/) | +| Inspect ProofOps control | [Hoxline](https://github.com/HawkinsOperations/hoxline) | +| Inspect claim enforcement | [Claim Firewall](https://hawkinsoperations.com/claim-firewall/) | +| Inspect proof records and ceilings | [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof) | +| Inspect controlled validation | [hawkinsoperations-validation](https://github.com/HawkinsOperations/hawkinsoperations-validation) | +| Inspect detection source | [hawkinsoperations-detections](https://github.com/HawkinsOperations/hawkinsoperations-detections) | +| Inspect contracts and control mechanics | [hawkinsoperations-platform](https://github.com/HawkinsOperations/hawkinsoperations-platform) | +| Compare repository authority | [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) | +| Check current bounded wording | [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md) | +| See controls that fired | [Governance Saves](https://hawkinsoperations.com/governance-saves/) | +| Run public checks | [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) | +| View coordination state | [Public Control Board](https://github.com/orgs/HawkinsOperations/projects/3) | -Current HawkinsOperations claims are bounded by source, validation, evidence, and the public-proof surface. +Changing counts and statuses stay in their source-owned records. This profile routes to those records instead of copying volatile metrics. ---- +## Coordination boundary -## Real controls rule +The public Control Board is a routing snapshot. The canonical private HawkinsOperations Control Board is Project #2. Project #1 is not an active reviewer route. Project metadata remains coordination-only. Project metadata is not proof or approval. Only an authorized human can approve a merge; runtime truth, signal truth, and public-safe status remain separate. -Repo separation creates review boundaries. Real control comes from required review, deterministic verification, CI checks, proof records, and bounded public wording. The split is necessary; it is not sufficient. Treat the boundary as the artifact, not the architecture diagram. +Detailed governance and standing-control material remains available in the [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md), [PR Review Authority](../governance/PR_REVIEW_AUTHORITY.md), and [standing control receipts](../governance/ISSUE_FACTORY_CONTROL_RECEIPTS.md). --- -
- -## AI is labor. Governance is authority. - -**AI generates work. Evidence and human review authorize claims.** +## Operating doctrine -**Build loud. Verify hard. Claim tight. Ship receipts.** +**AI is labor. Governance is authority.** -[Operator profile](https://github.com/raylee-hawkins) · [Proof ledger](https://hawkinsoperations.com/proof/) · [GitHub organization](https://github.com/HawkinsOperations) - -
+Build loud. Verify hard. Claim tight. Ship receipts. diff --git a/profile/START_HERE.md b/profile/START_HERE.md index 74e9357..bea09d5 100644 --- a/profile/START_HERE.md +++ b/profile/START_HERE.md @@ -1,249 +1,133 @@ # Start Here -Start here if reviewing HawkinsOperations. - -HawkinsOperations is a governed AI Security Operations and detection engineering system built around Hoxline, source-controlled detection work, deterministic validation, platform contracts, proof records, reviewer releases, Windows/Linux runtime candidate lanes, ledger mechanics, and human-review gates. - -The system separates Hoxline product/front-door work, detection source, validation, platform contracts, proof records, governance routing, and public rendering so public claims cannot outrun evidence. - -- AI is labor; governance is authority. -- AI can accelerate detection drafting, triage reasoning, case-packet support, documentation, and automation planning. -- AI does not decide disposition, approve claims, promote proof, or close cases. -- Validation, evidence records, proof boundaries, deterministic checks, and human review authorize operational truth. -- Green CI is evidence for the checked scope, not approval. -- Website/GitHub rendering is not proof. -- Hoxline by HawkinsOperations is the current product/front-door repo. -- Hoxline provides ProofOps control for the AI security era. -- Hoxline governs how AI-assisted security work becomes tested, reviewed, blocked, or safe to claim. -- Hoxline separates AI output from evidence-bound claim authority. -- Doctrine: AI is not the authority. Evidence is. -- Claim Authority governs what can be claimed. Claim Firewall is the first Claim Authority enforcement capability inside Hoxline; it is not the product, platform, front-door repo, an eighth repo, proof authority, runtime proof, or signal proof. -- Current repository path: HawkinsOperations/hoxline. -- AevumGuard was a prior working name. Hoxline is the current product name. - -Start with the system signal, then inspect the receipts: - -| Current operating signal | Value | Boundary | -|---|---:|---| -| Lifetime Governed Cases | See platform ledger state manifest | Current strict platform ledger count; public-safe and closed-case counts remain authority-owned by platform/proof records. | -| Windows Runtime Collector candidates | See platform runtime-candidate records | Private candidate lane only. | -| Linux Runtime Collector candidates | See platform runtime-candidate records | Private candidate lane only. | -| Normalized append-ready candidates | See platform normalizer records | Candidate status does not become governed case truth without explicit approval and verifier gates. | -| Controlled validation activity fires | See reviewer metrics summary | Validation activity, not governed cases or runtime signals. | -| Validation cases | See reviewer metrics summary | Controlled/reviewer activity scale, not production coverage. | -| Proof records | See reviewer metrics summary | Proof-record routing count, not public-safe approval. | -| Blocked claims | See reviewer metrics summary | Claim-control count, not missing functionality. | - -Private candidate lanes and normalizer outputs are governed by platform-owned records. Candidate status does not create runtime truth, signal truth, public-safe proof, or governed case truth by being summarized here. - -## First receipts - -| First check | What it shows | Boundary | -|---|---|---| -| [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) | PowerShell EncodedCommand detection route, source, Splunk source, controlled validation, proof record, and public ceiling. | `CONTROLLED_TEST_VALIDATED`; runtime, signal, production, and public-safe claims remain blocked. | -| [Proof Pack 001 Release](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) | Bounded reviewer ZIP, SHA256, and verifier route for HO-DET-001. | Reviewer release only; not public-safe runtime proof. | -| [Reviewer metrics summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/reviewer-metrics-pipeline-v1-summary.json) | Reviewer Metrics Pipeline v1 source record for controlled validation activity, validation cases, proof records, and blocked claims. | Activity metrics are not governed cases, runtime signals, or public-safe proof. | -| [Runtime Route Proof v1 reviewer map](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/maps/RUNTIME-ROUTE-PROOF-V1-REVIEWER-MAP.md) | Private-candidate Wazuh -> Cribl -> Splunk route summary and prerelease. | `NOT_PUBLIC_SAFE`; not public runtime proof, production proof, or broad-ingestion proof. | +HawkinsOperations is a governed AI Security Operations and detection engineering system for turning AI-assisted security work into bounded, inspectable artifacts. AI produces labor; evidence and human review authorize claims. -## Authority engines +## Three doors -| Engine | What it owns | Why it matters | +| Goal | Route | Role | |---|---|---| -| Detections | Source truth | Detection logic and metadata stay source-controlled and reviewable. | -| Validation | Behavior truth | Controlled cases, case-packet checks, parity checks, AI-boundary checks, and runner trust split prove behavior inside scope. | -| Platform | Control mechanics | Contracts, schemas, factory commands, ledgers, append gates, runtime candidate lanes, and verifier guardrails make the operating model executable. | -| Proof | Claim authority | Proof records, claim ceilings, proof packs, reviewer maps, blocked claims, and releases decide what can be claimed. | -| Website | Rendering | Public cockpit and reviewer routes, not proof authority. | -| `.github` | Command center | Org front door, reviewer routing, and authority boundaries. | -| Hoxline | Product front door | Hoxline by HawkinsOperations is the current product/front-door repo and ProofOps control surface. Claim Firewall is its first internal Claim Authority enforcement capability. | +| Understand or present HawkinsOperations | [Website / Reviewer Guide](https://hawkinsoperations.com/) · [presentation mode](https://hawkinsoperations.com/?present=1&scene=1) | Visual system walkthrough and presentation surface. Rendering is not proof. | +| Explore the product | [Hoxline](https://hawkinsoperations.com/hoxline/) | ProofOps control and Claim Authority for AI-assisted security work. | +| Verify the work | [GitHub organization](https://github.com/HawkinsOperations) | Source, validation, proof records, contracts, governance, and reviewer receipts. | -Platform is the mechanical control layer: contracts, factory commands, ledger mechanics, case-packet schemas, runtime candidate gates, reviewer metrics state, and verifier scripts. It does not own proof promotion or public-safe runtime truth. +## 30-second reviewer path -Validation is the behavior engine: controlled cases, local case pipeline, registry checks, activity ledger, parity checks, blocked-claim scans, AI authority boundaries, and runner trust separation. It does not prove live runtime, signal-observed public proof, or production deployment. +1. Open the [Website Reviewer Guide](https://hawkinsoperations.com/) or [start presentation mode](https://hawkinsoperations.com/?present=1&scene=1) to understand the complete system. +2. Open [Hoxline](https://hawkinsoperations.com/hoxline/) to see the product control surface. +3. Inspect the [HO-DET-001 proof route](https://hawkinsoperations.com/proof/ho-det-001/) for one bounded example. +4. Use the [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) to see which repository owns each truth. -Proof is the public trust anchor: proof records, claim ceilings, Proof Pack 001, Runtime Route Proof v1, reviewer maps, release routes, and proof-boundary case studies. Proof records authorize only their stated scope. +Outcome: you should be able to explain the problem, the control loop, where human authority remains mandatory, and why website rendering does not become proof. -The enterprise AI failure mode is that AI-generated output becomes a public claim, analyst conclusion, operational action, security disposition, or executive truth before evidence and human review authorize it. HawkinsOperations is built to prevent that promotion path. +## 3-minute command-center path -Current public proof is intentionally bounded. Runtime-active, signal-observed, production, SOCaaS, autonomous SOC, AI-approved disposition, analyst-approved disposition, and public-safe runtime claims remain blocked unless separately proven. Blocked claims feed Hoxline Claim Authority; they are not failed features. +Follow one detection across its owners: -HawkinsOperations separates source, validation, runtime, signal, evidence, and public-claim truth. Each truth surface has a different owner and promotion gate. +1. **View source:** [HO-DET-001 detection package](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001). +2. **View validation:** [controlled validation result](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md). +3. **View proof:** [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md). +4. **View the packaged receipt:** [Proof Pack 001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001). +5. **Inspect claim enforcement:** [Claim Firewall](https://hawkinsoperations.com/claim-firewall/). +6. **Confirm the ceiling:** [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md). -Website content and GitHub rendering are routing only. Repository source proves source existence only. +Outcome: source, validation, proof, product control, and rendering remain inspectable without being treated as interchangeable authority. -HO-DET-001 current public repo proof level: CONTROLLED_TEST_VALIDATED. +## 10-minute reviewer path -HO-DET-001 private/internal runtime material: non-public boundary context only. +Run one fixture-based Hoxline loop, then inspect the same authority handoffs used by the bounded HO-DET-001 example: -HO-DET-001 public-safe status: NOT_PUBLIC_SAFE. +```powershell +git clone https://github.com/HawkinsOperations/hoxline.git +cd hoxline +$env:PYTHONDONTWRITEBYTECODE = "1" +python -B -m hoxline demo quickstart +``` -HO-DET-001 has merged source, Splunk source, and controlled-test validation artifacts. The public proof record supports controlled-test validation against controlled positive and negative process-creation fixtures. +Then compare the generated reviewer artifacts with the [HO-DET-001 source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001), [controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md), and [proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md). The demo is local and fixture-based; it does not establish live runtime, signal, production, public-safe, or disposition truth. -HO-DET-001 validation enforcement exists through `HawkinsOperations/hawkinsoperations-validation#10`, merge commit `8b48500d2ebbaacd93ac88e77a31dccf1d3b4e25`, only for the exact checked controlled-test validation scope and only where the workflow is required by branch protection or a ruleset. +For the full seven-repository sweep, continue with the [extended Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md). -Proof-loop CI is a real control only where branch protection or a ruleset requires it, and only for the checked controlled-test validation scope. It does not prove runtime-active, signal-observed, evidence-linked public proof, public-safe, production-ready, fleet-wide, Cribl-routed, Wazuh-routed, AWS-live, private runtime host activity, autonomous SOC, or AI-approved disposition. +For the organization routing and claim-boundary check: -Platform runtime contract enforcement exists for HO-DET-001 through `HawkinsOperations/hawkinsoperations-platform#5`, merge commit `b3d0ffbd66c1bd5f60f7e9ff99712cdc3e0595bd`. The verifier preserves `CONTROLLED_TEST_VALIDATED`, `NOT_PUBLIC_SAFE`, `BLOCKED`, `runtime_active=false`, `signal_observed=false`, and `ai_decided_disposition=false`. +```powershell +$env:PYTHONDONTWRITEBYTECODE = "1" +python -B scripts/verify-command-center-invariants.py +``` -This platform contract is a non-promotional guardrail. It does not prove runtime-active status, signal-observed public proof, public-safe runtime proof, live Splunk fired, Splunk-proven Runtime Signal 001, Cribl-routed status, Wazuh-routed public proof, production-ready status, fleet-wide coverage, AWS-live status, autonomous SOC operation, AI-approved disposition, or analyst-approved disposition. +Expected result: -HO-DET-001 has private/internal runtime boundary context through validation PR [#22](https://github.com/HawkinsOperations/hawkinsoperations-validation/pull/22), proof PR [#14](https://github.com/HawkinsOperations/hawkinsoperations-proof/pull/14), and the proof record. This is not public-safe proof and must not be represented as runtime-active deployment, signal-observed public proof, production, fleet-wide, Cribl-routed, Wazuh-routed, AWS-live, autonomous SOC, AI-approved disposition, analyst-approved disposition, or public-safe status. +```text +COMMAND_CENTER_INVARIANTS=PASS +``` -HOD-001 baseline artifacts do not validate HO-DET-001. They may inform review, but they do not promote the successor detection ID. +The verifier checks only its declared routing, exposure, and claim-boundary invariants. It does not establish runtime truth, signal truth, public-safe status, proof promotion, merge authority, or human approval. -Public claims require reviewed wording, evidence linkage, stale review, and approval. +## Seven-repository authority -## Reviewer Control Panel +| Repository | Owns | Does not own | +|---|---|---| +| [HawkinsOperations/.github](https://github.com/HawkinsOperations/.github) | Organization routing and governance shell | Proof or operational truth | +| [HawkinsOperations/hoxline](https://github.com/HawkinsOperations/hoxline) | Product and ProofOps control | Proof records or final approval | +| [hawkinsoperations-detections](https://github.com/HawkinsOperations/hawkinsoperations-detections) | Detection source truth | Validation, runtime, signal, or proof truth | +| [hawkinsoperations-validation](https://github.com/HawkinsOperations/hawkinsoperations-validation) | Controlled validation truth | Live runtime, signal, production, or disposition truth | +| [hawkinsoperations-platform](https://github.com/HawkinsOperations/hawkinsoperations-platform) | Contracts and control mechanics | Proof promotion or claim authority | +| [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof) | Evidence records and claim ceilings | Claims beyond the recorded ceiling | +| [hawkinsoperations-website](https://github.com/HawkinsOperations/hawkinsoperations-website) | Public rendering and presentation | Source, validation, runtime, signal, or proof authority | -### 30-second reviewer path +No eighth system repository is implied. See the [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) for the detailed contract. -1. Clone [Hoxline](https://github.com/HawkinsOperations/hoxline), then run `python -B -m hoxline demo quickstart` from the repo root. -2. Read `.hoxline/demo-runs//reviewer-pack.md`. The demo is deterministic, local, fixture-based, and not runtime proof. -3. Open the [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) and [Proof Pack 001 Release](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) to verify the flagship proof route and bounded reviewer release. -4. Open the [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) to see which repo owns source, validation, platform, proof, website rendering, org routing, and the Hoxline product/front door. -5. Treat every website/GitHub page as routing unless the owning proof record supports the claim. The Hoxline demo keeps `NOT_PUBLIC_SAFE`, requires human review, and does not promote public proof. +## What AI does—and who decides -### 3-minute command-center path -1. Complete the 30-second reviewer path above. -2. Open the [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) to confirm which repo owns each truth surface. -3. Open the [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md) to confirm the current claim ceiling and blocked claims. -4. Open the [Proof Pack 001 Release](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) and [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) for proof-owned claim boundaries. -5. Open the [Runtime Route Proof v1 reviewer map](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/maps/RUNTIME-ROUTE-PROOF-V1-REVIEWER-MAP.md) and [private-candidate prerelease](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/runtime-route-proof-v1-private-candidate-2026-06-01) only for the private Wazuh -> Cribl -> Splunk route summary; it remains `NOT_PUBLIC_SAFE` and does not prove public-safe runtime proof, production SOC operation, autonomous SOC behavior, broad ingestion, AI-decided disposition, public publication approval, or Lifetime Governed Case mutation. -6. Open the [Standing control registers](../governance/ISSUE_FACTORY_CONTROL_RECEIPTS.md) to inspect the maintained blocked-claims register for #10 and enforcement/control-class ledger for #8. Both remain open standing controls unless Raylee approves a replacement standing-control role. -7. If you are reviewing internal operating context, open the [private org Control Board route](https://github.com/orgs/HawkinsOperations/projects/2). Treat it as work coordination only, not proof, approval, runtime state, signal state, public-safe status, or merge authority. Project #1 is not an active reviewer route. -8. Open the [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) only if you want clone-runnable inspection steps. +| AI can accelerate | AI cannot authorize | +|---|---| +| Drafting, detection logic assistance, query translation, summaries, enrichment, reviewer notes, documentation, and repetitive implementation | Evidence sufficiency, detection or incident disposition, approval, merge authority, claim promotion, public-safe status, production status, or case closure | -Current governed ledger snapshot: the platform-owned Lifetime Case Ledger state manifest is authoritative for ledger events, total cases, public-safe cases, and closed cases. Ledger status remains `NOT_PUBLIC_SAFE`; front-door/status proof ceiling remains `SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY`. +Hoxline carries this boundary through the review loop. Claim Firewall is one Hoxline enforcement capability; it checks configured wording policy and blocks unsupported claims. It is not proof authority, runtime proof, signal proof, or an eighth repository. -Current Reviewer metrics pipeline values live in the proof-owned reviewer metrics summary and related source records. This front door routes to those records instead of copying changing counts into public-front-door text. Project Board reconciliation status remains `REPO_BACKED_RECONCILIATION_PLAN_NO_PROJECT_MUTATION`. +## The current bounded example -Reviewer metrics boundary: the current Lifetime Governed Cases number stays strict and comes from the platform-owned Lifetime Case Ledger route. Detection Activity / controlled validation fire count, Validation Case Count, Proof Record Count, and Blocked Claim Count are separate reviewer activity metrics and must not be counted as governed cases. Project Board reconciliation is repo-backed routing/status only; Project metadata is not proof authority and no GitHub Project mutation is performed by this pipeline. +HO-DET-001 has source artifacts, platform-specific query source, controlled positive and negative fixtures, deterministic validation output, and a proof record. Its current public ceiling is `CONTROLLED_TEST_VALIDATED`. -Runtime Route Proof v1 private-candidate boundary: the proof repo routes a reviewer map and prerelease for one private controlled Wazuh -> Cribl -> Splunk marker summary. Claim ceiling remains `PRIVATE_RUNTIME_ROUTE_PROOF_V1_CANDIDATE_PRESERVED`; public-safe status remains `NOT_PUBLIC_SAFE`; it does not mutate the Lifetime Governed Case ledger; `AI_DECIDED_DISPOSITION=false`. +That ceiling supports only the stated controlled-test scope. Runtime-active public proof, signal-observed public proof, production readiness, customer deployment, fleet-wide coverage, SOCaaS operation, autonomous SOC behavior, AI-approved disposition, analyst-approved disposition, public-safe runtime evidence, and case closure remain unproven here. -### 10-minute reviewer path +`NOT_PUBLIC_SAFE` and `SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY` are separate bounded statuses. They do not combine with `CONTROLLED_TEST_VALIDATED` to create a stronger claim. -1. Complete the 3-minute command-center path above. -2. Run the [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) for clone-runnable source, validation, and proof inspection. -3. Run `python scripts/verify-command-center-invariants.py` from the `.github` repo to check command-center route and claim-boundary invariants. -4. Treat verifier success as validation truth only for the checked invariant scope. It does not prove runtime, signal, public-safe, production, Project-board approval, or merge authority. +Website/GitHub rendering is not proof. Green CI is not merge authority. Human review remains mandatory. -### What to click first +## Source-owned status routes -| Question | Click | -|---|---| -| What is HawkinsOperations? | [Organization profile](./README.md) | -| Which repo owns which truth? | [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) | -| What is proven and what is blocked? | [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md) | -| Where are the standing control ledgers? | [Standing control registers](../governance/ISSUE_FACTORY_CONTROL_RECEIPTS.md) | -| Where are proof records? | [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof) | -| Where is the main product/front-door repo? | [hoxline](https://github.com/HawkinsOperations/hoxline) | -| Where is the Runtime Route Proof v1 private-candidate route? | [Reviewer map](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/maps/RUNTIME-ROUTE-PROOF-V1-REVIEWER-MAP.md) and [prerelease](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/runtime-route-proof-v1-private-candidate-2026-06-01) | -| Where are validators and case packets? | [hawkinsoperations-validation](https://github.com/HawkinsOperations/hawkinsoperations-validation) | -| Where is detection source? | [hawkinsoperations-detections](https://github.com/HawkinsOperations/hawkinsoperations-detections) | -| Where is public rendering? | [hawkinsoperations-website](https://github.com/HawkinsOperations/hawkinsoperations-website) | -| Where is the operating cockpit? | [private org Control Board route](https://github.com/orgs/HawkinsOperations/projects/2) | -| Where is the current governed ledger state? | [Platform ledger state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) | -| Where is the reviewer metrics summary? | [Reviewer metrics proof summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/reviewer-metrics-pipeline-v1-summary.json) | - -### What each repo owns - -| Repo | Owns | Does not own | +Changing metrics stay in authority-owned records rather than this front door. + +| Surface | Source route | Separation rule | |---|---|---| -| `.github` | Command-center routing and governance shell. | Proof, runtime state, signal state, or public-safe approval. | -| `hawkinsoperations-detections` | Detection source truth. | Validation, runtime, signal, or public proof. | -| `hawkinsoperations-validation` | Behavior truth, fixtures, case packets, parity checks, and deterministic checks. | Runtime deployment or public-safe proof. | -| `hawkinsoperations-platform` | Control mechanics, contracts, ledgers, append gates, runtime candidate lanes, and guardrail logic. | Public proof or production readiness. | -| `hawkinsoperations-proof` | Claim authority, proof records, evidence boundaries, and claim ceilings. | Raw private evidence publication or claim expansion by presentation. | -| `hawkinsoperations-website` | Public rendering and reviewer cockpit. | Proof authority. | -| `hoxline` | Current product/front-door repo for Hoxline by HawkinsOperations. Claim Firewall is the first internal Claim Authority enforcement capability inside Hoxline. | Proof authority, runtime state, signal state, public-safe approval, or an eighth-repo expansion path. | -| `aevumguard` | Historical redirect/prior-name context only. AevumGuard was a prior working name. Hoxline is the current product name. | Current product identity, current repo identity, proof authority, runtime state, signal state, public-safe approval, or an eighth-repo expansion path. | - -### What is proven vs blocked - -| Status | Current reviewer-safe wording | +| Reviewer metrics pipeline | [proof-owned reviewer metrics summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/reviewer-metrics-pipeline-v1-summary.json) | Snapshot only; it does not create current ledger truth. | +| Lifetime Governed Cases | [platform ledger state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) | Governed ledger state remains separate from activity volume. | +| Detection Activity / controlled validation fire count | [validation activity ledger](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/activity/detection-activity-ledger-v1.md) | Controlled validation activity is not runtime signal. | +| Validation Case Count | [validation registry](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/validation/VALIDATION_REGISTRY.yml) | Validation volume is not production coverage. | +| Proof Record Count | [proof status index](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/indexes/DETECTION_PROOF_STATUS_INDEX.yml) | Record count is not proof promotion. | +| Blocked Claim Count | [proof-owned reviewer metrics summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/reviewer-metrics-pipeline-v1-summary.json) | Blocked-claim volume is not missing functionality. | +| Project Board reconciliation status | [Public Control Board](https://github.com/orgs/HawkinsOperations/projects/3) | Project metadata remains coordination-only. | + +## Reviewer links + +| Need | Route | |---|---| -| Proven within current public ceiling | HO-DET-001 source exists and controlled-test validation is recorded for the stated fixture scope. | -| Route-safe | GitHub and website surfaces route reviewers to source, validation, and proof records. | -| Ledger route-safe | The platform-owned Lifetime Case Ledger state manifest routes bounded current ledger status without making this front door the authority for copied counts. | -| Reviewer metrics route-safe | The reviewer metrics pipeline routes separate bounded values for Lifetime Governed Cases, Detection Activity / controlled validation fire count, Validation Case Count, Proof Record Count, Blocked Claim Count, and Project Board reconciliation status. | -| Runtime route private-candidate route-safe | Runtime Route Proof v1 routes one private controlled Wazuh -> Cribl -> Splunk marker summary to proof records and a prerelease; it remains `NOT_PUBLIC_SAFE` and does not promote public-safe runtime proof, production SOC operation, autonomous SOC behavior, broad ingestion, AI-decided disposition, public publication approval, or Lifetime Governed Case mutation. | -| Blocked | Runtime-active, signal-observed, public-safe runtime proof, production-ready, autonomous SOC, AI-approved disposition, analyst-approved disposition, Cribl-routed, Wazuh-routed, AWS-live, fleet-wide, and live Splunk firing claims. | - -### What not to infer - -Do not infer runtime operation, signal observation, production readiness, fleet scope, public-safe approval, analyst disposition, AI disposition, or public proof from GitHub rendering, website rendering, issue status, private Control Board membership, branch names, diagrams, or docs alone. - -The private Control Board exists for internal governance and navigation. It is not proof and is not public. - -```mermaid -flowchart LR - A[Detection Source] --> B[Validation] - B --> C[Platform / Contracts] - C --> D[Proof Records] - D --> E[Website / Org Rendering] - F[Blocked Claims] -. boundary .-> D - G[Private Control Board] -. governance navigation only .-> D - H[Human Review] -. approval gate .-> D - E -. rendering is not proof .-> F -``` +| Visual presentation | [Website Reviewer Guide](https://hawkinsoperations.com/) | +| Product control | [Hoxline repository](https://github.com/HawkinsOperations/hoxline) | +| Proof authority | [hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof) | +| Detection source | [hawkinsoperations-detections](https://github.com/HawkinsOperations/hawkinsoperations-detections) | +| Controlled validation | [hawkinsoperations-validation](https://github.com/HawkinsOperations/hawkinsoperations-validation) | +| Platform contracts | [hawkinsoperations-platform](https://github.com/HawkinsOperations/hawkinsoperations-platform) | +| Public rendering source | [hawkinsoperations-website](https://github.com/HawkinsOperations/hawkinsoperations-website) | +| Detailed authority | [Repository Authority Map](../architecture/REPO_AUTHORITY_MAP.md) | +| Clone-runnable checks | [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) | +| Control wording | [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md) | +| Review and merge boundary | [PR Review Authority](../governance/PR_REVIEW_AUTHORITY.md) | + +## Coordination boundary + +The canonical private HawkinsOperations Control Board is Project #2. Project #1 is not an active reviewer route. Project metadata remains coordination-only. Project metadata is not proof or approval. Only an authorized human can approve a merge; runtime truth, signal truth, public-safe status, and final disposition remain separate. + +--- -## Reviewer Links - -- [Organization profile](./README.md) -- [Organization system map](../wiki/11_ORG_SYSTEM_MAP.md) -- [Cross-repo promotion map](../governance/CROSS_REPO_PROMOTION_MAP.md) -- [Governance summary](../governance/GOVERNANCE_SUMMARY.md) -- [PR review authority](../governance/PR_REVIEW_AUTHORITY.md) - merge governance routing; not runtime, signal, evidence, public-safe, or production proof unless backed by rulesets or blocking CI -- [Repository authority map](../architecture/REPO_AUTHORITY_MAP.md) -- [Control status matrix](../governance/CONTROL_STATUS_MATRIX.md) -- [Standing control registers](../governance/ISSUE_FACTORY_CONTROL_RECEIPTS.md) - blocked-claims register for #10 and enforcement/control-class ledger for #8; remain open standing controls unless Raylee approves a replacement standing-control role; report-only unless backed by fail-closed controls -- [Command-center invariants](../governance/COMMAND_CENTER_INVARIANTS.json) and verifier - route and claim-boundary invariant check; validation truth only for checked scope -- [Proof Pack 001 official GitHub Release](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) - bounded reviewer ZIP route for HO-DET-001; ZIP SHA256 `44d8a643aa2b113c9e99be0462e699d39af707a67190823cc05bb381907dc452`; public-safe runtime proof remains BLOCKED -- [Runtime Route Proof v1 reviewer map](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/maps/RUNTIME-ROUTE-PROOF-V1-REVIEWER-MAP.md) and [private-candidate prerelease](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/runtime-route-proof-v1-private-candidate-2026-06-01) - private Wazuh -> Cribl -> Splunk route summary only; public-safe runtime proof, production SOC operation, autonomous SOC behavior, broad ingestion, AI-decided disposition, public publication approval, and Lifetime Governed Case mutation remain blocked -- [Proof Pack 001 Discussion](https://github.com/orgs/HawkinsOperations/discussions/32) - official announcement route; rendering is not proof -- [Private org Control Board route](https://github.com/orgs/HawkinsOperations/projects/2) - operating cockpit for current work visibility; Project #1 is not an active reviewer route; not proof authority, merge authority, or project metadata approval -- [Platform ledger state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) - current bounded governed ledger count summary; ledger status remains `NOT_PUBLIC_SAFE` -- [Reviewer metrics proof summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/reviewer-metrics-pipeline-v1-summary.json) - bounded reviewer metrics route; keeps strict governed cases separate from broader activity counts and Project Board reconciliation status -- [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) -- [HO-DET-001 runtime packet verifier PR #22](https://github.com/HawkinsOperations/hawkinsoperations-validation/pull/22) -- [HO-DET-001 verified runtime match proof PR #14](https://github.com/HawkinsOperations/hawkinsoperations-proof/pull/14) -- [HO-DET-001 platform runtime contract](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/examples/ho-det-001-runtime-contract.sample.json) -- [hawkinsoperations.com](https://hawkinsoperations.com) - current public rendering route, not proof -- [rayleeops.com](https://rayleeops.com) - public operating journal / external context, not HawkinsOperations proof -- [hawkinsops.com](https://hawkinsops.com) - legacy/reference route, not current proof authority - -## Review Boundary - -Allowed current wording: - -- "HO-DET-001 source exists." -- "HO-DET-001 Splunk source exists." -- "HO-DET-001 passed controlled-test validation against controlled positive and negative process-creation fixtures." -- "HO-DET-001 validation enforcement exists for the exact checked controlled-test validation scope." -- "HO-DET-001 platform runtime contract enforcement exists as a non-promotional guardrail." -- "HO-DET-001 current public repo proof level is CONTROLLED_TEST_VALIDATED." -- "HO-DET-001 private/internal runtime material is non-public boundary context." -- "HO-DET-001 public-safe status is NOT_PUBLIC_SAFE." -- "HOD-001 baseline artifacts are separate reference material." - -Blocked current wording: - -- "HO-DET-001 is production-ready." -- "HO-DET-001 is fleet-wide." -- "HO-DET-001 is enterprise deployed." -- "HO-DET-001 is Cribl-routed." -- "HO-DET-001 is Wazuh-routed." -- "HO-DET-001 is public-safe." -- "HO-DET-001 public proof is complete." -- "Live Splunk fired as public proof." -- "HO-DET-001 is runtime-active" unless explicitly scoped to private controlled lab evidence. -- "HO-DET-001 has signal-observed status" unless explicitly scoped to private controlled lab signal observed. -- "HO-DET-001 is evidence-linked public proof." -- "HO-DET-001 has public-safe runtime proof." -- "HO-DET-001 has signal-observed public proof." -- "HO-DET-001 is AWS-live." -- "HO-DET-001 operates as autonomous SOC." -- "HO-DET-001 has AI-approved disposition." -- "HO-DET-001 has analyst-approved disposition." -- Any wording that exposes raw command lines, encoded payloads, LAN IPs, local artifact paths, raw CSV names, or screenshots as public evidence. +**AI is labor. Governance is authority.** diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index e25af3b..502b9e2 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -12,16 +12,31 @@ ROOT = Path(__file__).resolve().parents[1] MANIFEST_PATH = ROOT / "governance" / "COMMAND_CENTER_INVARIANTS.json" TEXT_SCOPES = ["README.md", "profile", "architecture", "governance", "wiki", ".github"] +SYSTEM_REPOSITORIES = ( + ".github", + "hoxline", + "hawkinsoperations-detections", + "hawkinsoperations-validation", + "hawkinsoperations-platform", + "hawkinsoperations-proof", + "hawkinsoperations-website", +) REQUIRED_TEXT = { "README.md": [ ".github is routing/governance only", + "Website Reviewer Guide", + "Seven-Repository Authority", + "hoxline", "Project #1 is not an active reviewer route", "SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY", "NOT_PUBLIC_SAFE", "CONTROLLED_TEST_VALIDATED", ], "profile/README.md": [ + "Website / Reviewer Guide", + "Seven repositories, seven authority roles", + "AI produces labor. Evidence and human review authorize claims.", "Project #1 is not an active reviewer route", "project metadata is not proof", "SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY", @@ -29,6 +44,9 @@ "CONTROLLED_TEST_VALIDATED", ], "profile/START_HERE.md": [ + "Three doors", + "Website / Reviewer Guide", + "Seven-repository authority", "30-second reviewer path", "3-minute command-center path", "10-minute reviewer path", @@ -170,6 +188,56 @@ def check_required_text(errors: list[str]) -> None: fail(f"{rel} missing required wording: {needle}", errors) +def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: + manifest_repositories = tuple(manifest.get("system_repositories", [])) + if manifest_repositories != SYSTEM_REPOSITORIES: + fail("manifest system_repositories must list the exact seven repositories in authority order", errors) + + for rel in ("README.md", "profile/README.md", "profile/START_HERE.md", "architecture/REPO_AUTHORITY_MAP.md"): + text = read_text(ROOT / rel, errors).lower() + for repository in SYSTEM_REPOSITORIES: + if repository.lower() not in text: + fail(f"{rel} missing system repository role: {repository}", errors) + + profile_text = read_text(ROOT / "profile" / "README.md", errors) + profile = profile_text.lower() + if "https://hawkinsoperations.com/" not in profile: + fail("profile/README.md missing stable Website Reviewer Guide route", errors) + if "no eighth" not in profile: + fail("profile/README.md missing no-eighth-repository boundary", errors) + + section_match = re.search( + r"## Seven repositories, seven authority roles\s+(.*?)(?=\n## )", + profile_text, + re.DOTALL, + ) + if not section_match: + fail("profile/README.md missing parseable seven-repository authority table", errors) + return + repository_links = re.findall( + r"https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)", + section_match.group(1), + ) + if tuple(repository_links) != SYSTEM_REPOSITORIES: + fail( + "profile/README.md authority table must contain the exact seven repositories once in authority order", + errors, + ) + + required_role_language = ( + "Organization routing and governance shell", + "Product and ProofOps control surface", + "Detection source truth", + "Controlled validation truth", + "Contracts and control mechanics", + "Evidence records and claim ceilings", + "Public rendering and presentation", + ) + for role in required_role_language: + if role.lower() not in section_match.group(1).lower(): + fail(f"profile/README.md authority table missing role separation: {role}", errors) + + def check_project_boundaries(all_text: str, errors: list[str]) -> None: required = [ "hoxline", @@ -277,6 +345,7 @@ def main() -> int: manifest = load_manifest(errors) check_required_files(manifest, errors) check_required_text(errors) + check_front_door_authority_model(manifest, errors) text_files = iter_text_files() all_text = "\n".join(path.read_text(encoding="utf-8", errors="ignore") for path in text_files) From 3b6df215753443eb640fe6447eb982dbff178aa7 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 16:32:14 -0500 Subject: [PATCH 002/101] Complete organization reviewer routing --- governance/ORG_CI_CD_AUTHORITY_CONTRACT.md | 2 +- profile/README.md | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md index f165537..fae5ba5 100644 --- a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md +++ b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md @@ -63,7 +63,7 @@ Detection source can support `SOURCE_EXISTS`. Validation behavior can support co These notes are recorded for Phase 1 routing. They do not promote any repository or detection beyond the proof records and checks that actually exist. -- The mission audit previously reported the six HawkinsOperations repos as clean, synced, and carrying zero open PRs. Treat that as audit context, not proof of future state. +- A historical mission audit reported its then-scoped repository set as clean, synced, and carrying zero open PRs. Treat that as historical audit context, not proof of current or future state; the current HawkinsOperations authority model contains exactly seven repositories. - Detections PR #27 carried ID-DET-002, ID-DET-003, and ID-DET-004 source. - Validation PR #46 carried ID-DET-002, ID-DET-003, and ID-DET-004 controlled-test validation. - Platform PR #29 carried ID-DET-002, ID-DET-003, and ID-DET-004 status/plan visibility. diff --git a/profile/README.md b/profile/README.md index f346875..b7de448 100644 --- a/profile/README.md +++ b/profile/README.md @@ -30,7 +30,7 @@ Hoxline doctrine: AI is not the authority. Evidence is. | Time | Route | Outcome | |---:|---|---| -| **30 seconds** | [Open the Reviewer Guide](https://hawkinsoperations.com/) → [open Hoxline](https://hawkinsoperations.com/hoxline/) → [inspect HO-DET-001 proof](https://hawkinsoperations.com/proof/ho-det-001/) | Understand the system, the product control surface, and one bounded proof route. | +| **30 seconds** | [Open the Reviewer Guide](https://hawkinsoperations.com/) → [open Hoxline](https://hawkinsoperations.com/hoxline/) → [inspect HO-DET-001 proof](https://hawkinsoperations.com/proof/ho-det-001/) → [map repository authority](../architecture/REPO_AUTHORITY_MAP.md) | Understand the system, the product control surface, one bounded proof route, and which repository owns each truth. | | **3 minutes** | Follow [source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001) → [controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md) → [proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) → [Claim Firewall](https://hawkinsoperations.com/claim-firewall/) | See how one detection moves through separate truth surfaces while unsupported wording stays blocked. | | **10 minutes** | Use the [focused runnable path](START_HERE.md#10-minute-reviewer-path) | Run Hoxline's local fixture-based demo, then inspect the HO-DET-001 source, validation, proof, and claim boundary. | | **Extended** | Use the [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) | Clone all seven repositories and run their public checks without private runtime access. | From d379b54685760a1fe6901a8a2901bb1ceee14523 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 16:42:34 -0500 Subject: [PATCH 003/101] Harden organization reviewer verification --- profile/START_HERE.md | 8 +++-- scripts/verify-command-center-invariants.py | 34 ++++++++++++--------- 2 files changed, 25 insertions(+), 17 deletions(-) diff --git a/profile/START_HERE.md b/profile/START_HERE.md index bea09d5..1679d7d 100644 --- a/profile/START_HERE.md +++ b/profile/START_HERE.md @@ -34,10 +34,11 @@ Outcome: source, validation, proof, product control, and rendering remain inspec ## 10-minute reviewer path -Run one fixture-based Hoxline loop, then inspect the same authority handoffs used by the bounded HO-DET-001 example: +From an empty reviewer workspace, clone the organization route and Hoxline side by side. Then run one fixture-based Hoxline loop and inspect the same authority handoffs used by the bounded HO-DET-001 example: ```powershell -git clone https://github.com/HawkinsOperations/hoxline.git +git clone https://github.com/HawkinsOperations/.github.git .github +git clone https://github.com/HawkinsOperations/hoxline.git hoxline cd hoxline $env:PYTHONDONTWRITEBYTECODE = "1" python -B -m hoxline demo quickstart @@ -47,9 +48,10 @@ Then compare the generated reviewer artifacts with the [HO-DET-001 source](https For the full seven-repository sweep, continue with the [extended Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md). -For the organization routing and claim-boundary check: +Continue from the Hoxline repository by returning to the sibling organization repository for its routing and claim-boundary check: ```powershell +cd ..\.github $env:PYTHONDONTWRITEBYTECODE = "1" python -B scripts/verify-command-center-invariants.py ``` diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 502b9e2..a30e306 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -214,28 +214,34 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if not section_match: fail("profile/README.md missing parseable seven-repository authority table", errors) return - repository_links = re.findall( - r"https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)", + authority_rows = re.findall( + r"^\|\s*\[`([^`]+)`\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|", section_match.group(1), + re.MULTILINE, ) - if tuple(repository_links) != SYSTEM_REPOSITORIES: + repository_links = tuple(repository for _label, repository, _role in authority_rows) + if repository_links != SYSTEM_REPOSITORIES: fail( "profile/README.md authority table must contain the exact seven repositories once in authority order", errors, ) - required_role_language = ( - "Organization routing and governance shell", - "Product and ProofOps control surface", - "Detection source truth", - "Controlled validation truth", - "Contracts and control mechanics", - "Evidence records and claim ceilings", - "Public rendering and presentation", + required_authority_rows = ( + (".github", "Organization routing and governance shell"), + ("hoxline", "Product and ProofOps control surface"), + ("hawkinsoperations-detections", "Detection source truth"), + ("hawkinsoperations-validation", "Controlled validation truth"), + ("hawkinsoperations-platform", "Contracts and control mechanics"), + ("hawkinsoperations-proof", "Evidence records and claim ceilings"), + ("hawkinsoperations-website", "Public rendering and presentation"), ) - for role in required_role_language: - if role.lower() not in section_match.group(1).lower(): - fail(f"profile/README.md authority table missing role separation: {role}", errors) + for row, (expected_repository, expected_role) in zip(authority_rows, required_authority_rows): + label, repository, role = row + if label != expected_repository or repository != expected_repository or role.strip() != expected_role: + fail( + f"profile/README.md authority row mismatch for {expected_repository}: expected role {expected_role}", + errors, + ) def check_project_boundaries(all_text: str, errors: list[str]) -> None: From 7c3097ba0d9954caa88cc6da12d2ae9817e83f54 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 16:49:18 -0500 Subject: [PATCH 004/101] Bind authority roles across organization routes --- scripts/verify-command-center-invariants.py | 106 +++++++++++++------- 1 file changed, 72 insertions(+), 34 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index a30e306..7633126 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -206,42 +206,80 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if "no eighth" not in profile: fail("profile/README.md missing no-eighth-repository boundary", errors) - section_match = re.search( - r"## Seven repositories, seven authority roles\s+(.*?)(?=\n## )", - profile_text, - re.DOTALL, + authority_tables = ( + ( + "README.md", + "Seven-Repository Authority", + r"^\|\s*\d+\s*\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|", + ( + (".github", "Route / governance truth"), + ("hoxline", "Product / ProofOps control"), + ("hawkinsoperations-detections", "Source truth"), + ("hawkinsoperations-validation", "Behavior truth"), + ("hawkinsoperations-platform", "Contract / guardrail truth"), + ("hawkinsoperations-proof", "Claim / proof truth"), + ("hawkinsoperations-website", "Render truth"), + ), + ), + ( + "profile/README.md", + "Seven repositories, seven authority roles", + r"^\|\s*\[`[^`]+`\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|", + ( + (".github", "Organization routing and governance shell"), + ("hoxline", "Product and ProofOps control surface"), + ("hawkinsoperations-detections", "Detection source truth"), + ("hawkinsoperations-validation", "Controlled validation truth"), + ("hawkinsoperations-platform", "Contracts and control mechanics"), + ("hawkinsoperations-proof", "Evidence records and claim ceilings"), + ("hawkinsoperations-website", "Public rendering and presentation"), + ), + ), + ( + "profile/START_HERE.md", + "Seven-repository authority", + r"^\|\s*\[[^\]]+\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|", + ( + (".github", "Organization routing and governance shell"), + ("hoxline", "Product and ProofOps control"), + ("hawkinsoperations-detections", "Detection source truth"), + ("hawkinsoperations-validation", "Controlled validation truth"), + ("hawkinsoperations-platform", "Contracts and control mechanics"), + ("hawkinsoperations-proof", "Evidence records and claim ceilings"), + ("hawkinsoperations-website", "Public rendering and presentation"), + ), + ), + ( + "architecture/REPO_AUTHORITY_MAP.md", + "Authority Summary", + r"^\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|", + ( + (".github", "Reviewer routing / governance shell"), + ("hawkinsoperations-detections", "Source truth"), + ("hawkinsoperations-validation", "Validation truth"), + ("hawkinsoperations-platform", "Contracts / orchestration / control logic"), + ("hawkinsoperations-proof", "Proof records / evidence truth"), + ("hawkinsoperations-website", "Public rendering only"), + ("hoxline", "Product / ProofOps control"), + ), + ), ) - if not section_match: - fail("profile/README.md missing parseable seven-repository authority table", errors) - return - authority_rows = re.findall( - r"^\|\s*\[`([^`]+)`\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|", - section_match.group(1), - re.MULTILINE, - ) - repository_links = tuple(repository for _label, repository, _role in authority_rows) - if repository_links != SYSTEM_REPOSITORIES: - fail( - "profile/README.md authority table must contain the exact seven repositories once in authority order", - errors, + for rel, heading, row_pattern, expected_rows in authority_tables: + table_text = read_text(ROOT / rel, errors) + section_match = re.search( + rf"## {re.escape(heading)}\s+(.*?)(?=\n## |\Z)", + table_text, + re.DOTALL, ) - - required_authority_rows = ( - (".github", "Organization routing and governance shell"), - ("hoxline", "Product and ProofOps control surface"), - ("hawkinsoperations-detections", "Detection source truth"), - ("hawkinsoperations-validation", "Controlled validation truth"), - ("hawkinsoperations-platform", "Contracts and control mechanics"), - ("hawkinsoperations-proof", "Evidence records and claim ceilings"), - ("hawkinsoperations-website", "Public rendering and presentation"), - ) - for row, (expected_repository, expected_role) in zip(authority_rows, required_authority_rows): - label, repository, role = row - if label != expected_repository or repository != expected_repository or role.strip() != expected_role: - fail( - f"profile/README.md authority row mismatch for {expected_repository}: expected role {expected_role}", - errors, - ) + if not section_match: + fail(f"{rel} missing parseable authority table: {heading}", errors) + continue + actual_rows = tuple( + (repository, role.strip()) + for repository, role in re.findall(row_pattern, section_match.group(1), re.MULTILINE) + ) + if actual_rows != expected_rows: + fail(f"{rel} authority rows must bind each repository to its exact role", errors) def check_project_boundaries(all_text: str, errors: list[str]) -> None: From 6e9d874156a63dc524e7f1cb5046e7311ea73a3c Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 16:57:06 -0500 Subject: [PATCH 005/101] Enforce organization authority boundaries --- scripts/verify-command-center-invariants.py | 90 ++++++++++++--------- 1 file changed, 52 insertions(+), 38 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 7633126..79db2a8 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -201,8 +201,16 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: profile_text = read_text(ROOT / "profile" / "README.md", errors) profile = profile_text.lower() - if "https://hawkinsoperations.com/" not in profile: - fail("profile/README.md missing stable Website Reviewer Guide route", errors) + door_section = re.search( + r"## Choose the right door\s+(.*?)(?=\n## |\Z)", + profile_text, + re.DOTALL, + ) + if not door_section or not re.search( + r"\*\*\[Website / Reviewer Guide\]\(https://hawkinsoperations\.com/\)\*\*", + door_section.group(1), + ): + fail("profile/README.md must bind the Website / Reviewer Guide door to the stable Website route", errors) if "no eighth" not in profile: fail("profile/README.md missing no-eighth-repository boundary", errors) @@ -210,61 +218,65 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ( "README.md", "Seven-Repository Authority", - r"^\|\s*\d+\s*\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|", + "| Order | Repo | Truth surface | Boundary |", + r"^\|\s*\d+\s*\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Route / governance truth"), - ("hoxline", "Product / ProofOps control"), - ("hawkinsoperations-detections", "Source truth"), - ("hawkinsoperations-validation", "Behavior truth"), - ("hawkinsoperations-platform", "Contract / guardrail truth"), - ("hawkinsoperations-proof", "Claim / proof truth"), - ("hawkinsoperations-website", "Render truth"), + (".github", "Route / governance truth", "Routes reviewers and explains authority boundaries; does not prove claims."), + ("hoxline", "Product / ProofOps control", "Governs the review path and Claim Authority experience; does not own proof records or final approval."), + ("hawkinsoperations-detections", "Source truth", "Owns detection source, metadata, source reviewability, and source-level eligibility routing."), + ("hawkinsoperations-validation", "Behavior truth", "Owns controlled validation checks, case packets, replay scope, and recorded validation outputs."), + ("hawkinsoperations-platform", "Contract / guardrail truth", "Owns schemas, contracts, ledger guardrails, runtime-route guardrails, and non-promotional platform controls."), + ("hawkinsoperations-proof", "Claim / proof truth", "Owns proof records, proof ceilings, evidence-boundary records, and blocked-claim status."), + ("hawkinsoperations-website", "Render truth", "Renders the public Reviewer Guide and bounded reviewer navigation; rendering is not proof."), ), ), ( "profile/README.md", "Seven repositories, seven authority roles", - r"^\|\s*\[`[^`]+`\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|", + "| Repository | Authority role | Does not own |", + r"^\|\s*\[`[^`]+`\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Organization routing and governance shell"), - ("hoxline", "Product and ProofOps control surface"), - ("hawkinsoperations-detections", "Detection source truth"), - ("hawkinsoperations-validation", "Controlled validation truth"), - ("hawkinsoperations-platform", "Contracts and control mechanics"), - ("hawkinsoperations-proof", "Evidence records and claim ceilings"), - ("hawkinsoperations-website", "Public rendering and presentation"), + (".github", "Organization routing and governance shell", "Proof, runtime, signal, or merge authority"), + ("hoxline", "Product and ProofOps control surface", "Proof records, runtime proof, or final approval"), + ("hawkinsoperations-detections", "Detection source truth", "Validation, runtime, signal, or proof truth"), + ("hawkinsoperations-validation", "Controlled validation truth", "Live runtime, signal, production, or disposition truth"), + ("hawkinsoperations-platform", "Contracts and control mechanics", "Proof promotion or final human authority"), + ("hawkinsoperations-proof", "Evidence records and claim ceilings", "Broader claims than its records support"), + ("hawkinsoperations-website", "Public rendering and presentation", "Source, validation, runtime, signal, or proof authority"), ), ), ( "profile/START_HERE.md", "Seven-repository authority", - r"^\|\s*\[[^\]]+\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|", + "| Repository | Owns | Does not own |", + r"^\|\s*\[[^\]]+\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Organization routing and governance shell"), - ("hoxline", "Product and ProofOps control"), - ("hawkinsoperations-detections", "Detection source truth"), - ("hawkinsoperations-validation", "Controlled validation truth"), - ("hawkinsoperations-platform", "Contracts and control mechanics"), - ("hawkinsoperations-proof", "Evidence records and claim ceilings"), - ("hawkinsoperations-website", "Public rendering and presentation"), + (".github", "Organization routing and governance shell", "Proof or operational truth"), + ("hoxline", "Product and ProofOps control", "Proof records or final approval"), + ("hawkinsoperations-detections", "Detection source truth", "Validation, runtime, signal, or proof truth"), + ("hawkinsoperations-validation", "Controlled validation truth", "Live runtime, signal, production, or disposition truth"), + ("hawkinsoperations-platform", "Contracts and control mechanics", "Proof promotion or claim authority"), + ("hawkinsoperations-proof", "Evidence records and claim ceilings", "Claims beyond the recorded ceiling"), + ("hawkinsoperations-website", "Public rendering and presentation", "Source, validation, runtime, signal, or proof authority"), ), ), ( "architecture/REPO_AUTHORITY_MAP.md", "Authority Summary", - r"^\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|", + "| Repository | Authority plane | Owns | Boundary |", + r"^\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|\s*[^|]+?\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Reviewer routing / governance shell"), - ("hawkinsoperations-detections", "Source truth"), - ("hawkinsoperations-validation", "Validation truth"), - ("hawkinsoperations-platform", "Contracts / orchestration / control logic"), - ("hawkinsoperations-proof", "Proof records / evidence truth"), - ("hawkinsoperations-website", "Public rendering only"), - ("hoxline", "Product / ProofOps control"), + (".github", "Reviewer routing / governance shell", "Not proof; does not prove source, runtime, signal, evidence, public-safe status, or production readiness."), + ("hawkinsoperations-detections", "Source truth", "Source does not prove validation, runtime, signal, or public proof."), + ("hawkinsoperations-validation", "Validation truth", "Validation does not prove runtime deployment, public signal, or public-safe status."), + ("hawkinsoperations-platform", "Contracts / orchestration / control logic", "Contracts do not prove public proof, production readiness, or current runtime state."), + ("hawkinsoperations-proof", "Proof records / evidence truth", "Proof records do not publish raw private evidence or raise ceilings by presentation."), + ("hawkinsoperations-website", "Public rendering only", "Rendering is not proof and cannot approve a claim."), + ("hoxline", "Product / ProofOps control", "Product framing does not prove runtime, signal, evidence, public-safe status, production readiness, or approval."), ), ), ) - for rel, heading, row_pattern, expected_rows in authority_tables: + for rel, heading, expected_header, row_pattern, expected_rows in authority_tables: table_text = read_text(ROOT / rel, errors) section_match = re.search( rf"## {re.escape(heading)}\s+(.*?)(?=\n## |\Z)", @@ -274,12 +286,14 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if not section_match: fail(f"{rel} missing parseable authority table: {heading}", errors) continue + if expected_header not in section_match.group(1): + fail(f"{rel} authority table must preserve its exact ownership-boundary headers", errors) actual_rows = tuple( - (repository, role.strip()) - for repository, role in re.findall(row_pattern, section_match.group(1), re.MULTILINE) + (repository, role.strip(), boundary.strip()) + for repository, role, boundary in re.findall(row_pattern, section_match.group(1), re.MULTILINE) ) if actual_rows != expected_rows: - fail(f"{rel} authority rows must bind each repository to its exact role", errors) + fail(f"{rel} authority rows must bind each repository to its exact role and boundary", errors) def check_project_boundaries(all_text: str, errors: list[str]) -> None: From 72430ad756e411d83e8445128eac0989bb231a46 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:03:43 -0500 Subject: [PATCH 006/101] Parse complete authority tables --- scripts/verify-command-center-invariants.py | 86 ++++++++++++--------- 1 file changed, 49 insertions(+), 37 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 79db2a8..f0709c3 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -219,64 +219,60 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: "README.md", "Seven-Repository Authority", "| Order | Repo | Truth surface | Boundary |", - r"^\|\s*\d+\s*\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Route / governance truth", "Routes reviewers and explains authority boundaries; does not prove claims."), - ("hoxline", "Product / ProofOps control", "Governs the review path and Claim Authority experience; does not own proof records or final approval."), - ("hawkinsoperations-detections", "Source truth", "Owns detection source, metadata, source reviewability, and source-level eligibility routing."), - ("hawkinsoperations-validation", "Behavior truth", "Owns controlled validation checks, case packets, replay scope, and recorded validation outputs."), - ("hawkinsoperations-platform", "Contract / guardrail truth", "Owns schemas, contracts, ledger guardrails, runtime-route guardrails, and non-promotional platform controls."), - ("hawkinsoperations-proof", "Claim / proof truth", "Owns proof records, proof ceilings, evidence-boundary records, and blocked-claim status."), - ("hawkinsoperations-website", "Render truth", "Renders the public Reviewer Guide and bounded reviewer navigation; rendering is not proof."), + ("1", "`.github`", "Route / governance truth", "Routes reviewers and explains authority boundaries; does not prove claims."), + ("2", "`hoxline`", "Product / ProofOps control", "Governs the review path and Claim Authority experience; does not own proof records or final approval."), + ("3", "`hawkinsoperations-detections`", "Source truth", "Owns detection source, metadata, source reviewability, and source-level eligibility routing."), + ("4", "`hawkinsoperations-validation`", "Behavior truth", "Owns controlled validation checks, case packets, replay scope, and recorded validation outputs."), + ("5", "`hawkinsoperations-platform`", "Contract / guardrail truth", "Owns schemas, contracts, ledger guardrails, runtime-route guardrails, and non-promotional platform controls."), + ("6", "`hawkinsoperations-proof`", "Claim / proof truth", "Owns proof records, proof ceilings, evidence-boundary records, and blocked-claim status."), + ("7", "`hawkinsoperations-website`", "Render truth", "Renders the public Reviewer Guide and bounded reviewer navigation; rendering is not proof."), ), ), ( "profile/README.md", "Seven repositories, seven authority roles", "| Repository | Authority role | Does not own |", - r"^\|\s*\[`[^`]+`\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Organization routing and governance shell", "Proof, runtime, signal, or merge authority"), - ("hoxline", "Product and ProofOps control surface", "Proof records, runtime proof, or final approval"), - ("hawkinsoperations-detections", "Detection source truth", "Validation, runtime, signal, or proof truth"), - ("hawkinsoperations-validation", "Controlled validation truth", "Live runtime, signal, production, or disposition truth"), - ("hawkinsoperations-platform", "Contracts and control mechanics", "Proof promotion or final human authority"), - ("hawkinsoperations-proof", "Evidence records and claim ceilings", "Broader claims than its records support"), - ("hawkinsoperations-website", "Public rendering and presentation", "Source, validation, runtime, signal, or proof authority"), + ("[`.github`](https://github.com/HawkinsOperations/.github)", "Organization routing and governance shell", "Proof, runtime, signal, or merge authority"), + ("[`hoxline`](https://github.com/HawkinsOperations/hoxline)", "Product and ProofOps control surface", "Proof records, runtime proof, or final approval"), + ("[`hawkinsoperations-detections`](https://github.com/HawkinsOperations/hawkinsoperations-detections)", "Detection source truth", "Validation, runtime, signal, or proof truth"), + ("[`hawkinsoperations-validation`](https://github.com/HawkinsOperations/hawkinsoperations-validation)", "Controlled validation truth", "Live runtime, signal, production, or disposition truth"), + ("[`hawkinsoperations-platform`](https://github.com/HawkinsOperations/hawkinsoperations-platform)", "Contracts and control mechanics", "Proof promotion or final human authority"), + ("[`hawkinsoperations-proof`](https://github.com/HawkinsOperations/hawkinsoperations-proof)", "Evidence records and claim ceilings", "Broader claims than its records support"), + ("[`hawkinsoperations-website`](https://github.com/HawkinsOperations/hawkinsoperations-website)", "Public rendering and presentation", "Source, validation, runtime, signal, or proof authority"), ), ), ( "profile/START_HERE.md", "Seven-repository authority", "| Repository | Owns | Does not own |", - r"^\|\s*\[[^\]]+\]\(https://github\.com/HawkinsOperations/([A-Za-z0-9_.-]+)\)\s*\|\s*([^|]+?)\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Organization routing and governance shell", "Proof or operational truth"), - ("hoxline", "Product and ProofOps control", "Proof records or final approval"), - ("hawkinsoperations-detections", "Detection source truth", "Validation, runtime, signal, or proof truth"), - ("hawkinsoperations-validation", "Controlled validation truth", "Live runtime, signal, production, or disposition truth"), - ("hawkinsoperations-platform", "Contracts and control mechanics", "Proof promotion or claim authority"), - ("hawkinsoperations-proof", "Evidence records and claim ceilings", "Claims beyond the recorded ceiling"), - ("hawkinsoperations-website", "Public rendering and presentation", "Source, validation, runtime, signal, or proof authority"), + ("[HawkinsOperations/.github](https://github.com/HawkinsOperations/.github)", "Organization routing and governance shell", "Proof or operational truth"), + ("[HawkinsOperations/hoxline](https://github.com/HawkinsOperations/hoxline)", "Product and ProofOps control", "Proof records or final approval"), + ("[hawkinsoperations-detections](https://github.com/HawkinsOperations/hawkinsoperations-detections)", "Detection source truth", "Validation, runtime, signal, or proof truth"), + ("[hawkinsoperations-validation](https://github.com/HawkinsOperations/hawkinsoperations-validation)", "Controlled validation truth", "Live runtime, signal, production, or disposition truth"), + ("[hawkinsoperations-platform](https://github.com/HawkinsOperations/hawkinsoperations-platform)", "Contracts and control mechanics", "Proof promotion or claim authority"), + ("[hawkinsoperations-proof](https://github.com/HawkinsOperations/hawkinsoperations-proof)", "Evidence records and claim ceilings", "Claims beyond the recorded ceiling"), + ("[hawkinsoperations-website](https://github.com/HawkinsOperations/hawkinsoperations-website)", "Public rendering and presentation", "Source, validation, runtime, signal, or proof authority"), ), ), ( "architecture/REPO_AUTHORITY_MAP.md", "Authority Summary", "| Repository | Authority plane | Owns | Boundary |", - r"^\|\s*`([^`]+)`\s*\|\s*([^|]+?)\s*\|\s*[^|]+?\s*\|\s*([^|]+?)\s*\|$", ( - (".github", "Reviewer routing / governance shell", "Not proof; does not prove source, runtime, signal, evidence, public-safe status, or production readiness."), - ("hawkinsoperations-detections", "Source truth", "Source does not prove validation, runtime, signal, or public proof."), - ("hawkinsoperations-validation", "Validation truth", "Validation does not prove runtime deployment, public signal, or public-safe status."), - ("hawkinsoperations-platform", "Contracts / orchestration / control logic", "Contracts do not prove public proof, production readiness, or current runtime state."), - ("hawkinsoperations-proof", "Proof records / evidence truth", "Proof records do not publish raw private evidence or raise ceilings by presentation."), - ("hawkinsoperations-website", "Public rendering only", "Rendering is not proof and cannot approve a claim."), - ("hoxline", "Product / ProofOps control", "Product framing does not prove runtime, signal, evidence, public-safe status, production readiness, or approval."), + ("`.github`", "Reviewer routing / governance shell", "Organization profile, reviewer routes, governance summaries, and control-panel navigation.", "Not proof; does not prove source, runtime, signal, evidence, public-safe status, or production readiness."), + ("`hawkinsoperations-detections`", "Source truth", "Detection source logic and source ownership trail.", "Source does not prove validation, runtime, signal, or public proof."), + ("`hawkinsoperations-validation`", "Validation truth", "Fixtures, validators, case packets, deterministic checks, and workflow source.", "Validation does not prove runtime deployment, public signal, or public-safe status."), + ("`hawkinsoperations-platform`", "Contracts / orchestration / control logic", "Runtime contracts, interface boundaries, and non-promotional guardrails.", "Contracts do not prove public proof, production readiness, or current runtime state."), + ("`hawkinsoperations-proof`", "Proof records / evidence truth", "Proof records, claim ceilings, evidence boundary records, and cited case packets.", "Proof records do not publish raw private evidence or raise ceilings by presentation."), + ("`hawkinsoperations-website`", "Public rendering only", "Public reviewer navigation and rendered wording.", "Rendering is not proof and cannot approve a claim."), + ("`hoxline`", "Product / ProofOps control", "Hoxline product surface and Claim Authority capabilities, starting with Claim Firewall.", "Product framing does not prove runtime, signal, evidence, public-safe status, production readiness, or approval."), ), ), ) - for rel, heading, expected_header, row_pattern, expected_rows in authority_tables: + for rel, heading, expected_header, expected_rows in authority_tables: table_text = read_text(ROOT / rel, errors) section_match = re.search( rf"## {re.escape(heading)}\s+(.*?)(?=\n## |\Z)", @@ -286,14 +282,30 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if not section_match: fail(f"{rel} missing parseable authority table: {heading}", errors) continue - if expected_header not in section_match.group(1): + table_lines = [ + line.strip() + for line in section_match.group(1).splitlines() + if line.strip().startswith("|") + ] + if not table_lines or table_lines[0] != expected_header: fail(f"{rel} authority table must preserve its exact ownership-boundary headers", errors) + continue + if len(table_lines) < 2: + fail(f"{rel} authority table missing separator and data rows", errors) + continue + header_cells = tuple(cell.strip() for cell in table_lines[0].strip("|").split("|")) + separator_cells = tuple(cell.strip() for cell in table_lines[1].strip("|").split("|")) + if len(separator_cells) != len(header_cells) or any( + not re.fullmatch(r":?-{3,}:?", cell) for cell in separator_cells + ): + fail(f"{rel} authority table has an invalid Markdown separator row", errors) + continue actual_rows = tuple( - (repository, role.strip(), boundary.strip()) - for repository, role, boundary in re.findall(row_pattern, section_match.group(1), re.MULTILINE) + tuple(cell.strip() for cell in line.strip("|").split("|")) + for line in table_lines[2:] ) if actual_rows != expected_rows: - fail(f"{rel} authority rows must bind each repository to its exact role and boundary", errors) + fail(f"{rel} authority table must contain only the exact seven repository ownership rows", errors) def check_project_boundaries(all_text: str, errors: list[str]) -> None: From 87f75bc3597816a6687d587e0510e6dcc31629d9 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:08:46 -0500 Subject: [PATCH 007/101] Close organization verifier review gaps --- architecture/REPRODUCIBLE_REVIEWER_PATH.md | 2 +- scripts/verify-command-center-invariants.py | 23 +++++++++++++++++++-- 2 files changed, 22 insertions(+), 3 deletions(-) diff --git a/architecture/REPRODUCIBLE_REVIEWER_PATH.md b/architecture/REPRODUCIBLE_REVIEWER_PATH.md index c3a075e..f1c46a1 100644 --- a/architecture/REPRODUCIBLE_REVIEWER_PATH.md +++ b/architecture/REPRODUCIBLE_REVIEWER_PATH.md @@ -188,7 +188,7 @@ Private evidence can inform future review only after privacy review, stale revie The `.github` command-center route has a local invariant verifier for reviewer-route and claim-boundary checks: ```powershell -cd .github +cd ..\.github $env:PYTHONDONTWRITEBYTECODE = "1" python -B scripts\verify-command-center-invariants.py ``` diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index f0709c3..5fc596b 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -21,6 +21,25 @@ "hawkinsoperations-proof", "hawkinsoperations-website", ) +EXPECTED_INVARIANTS = { + "github_repo_role": ".github is reviewer routing and governance shell only", + "presentation_route": "hawkinsoperations.com is the Website Reviewer Guide and presentation surface", + "seven_repository_authority": "HawkinsOperations has exactly seven system repositories with separate authority roles", + "hoxline_role": "Hoxline is the product and ProofOps control surface, not proof authority", + "project_2_role": "Project #2 is the canonical private HawkinsOperations Control Board operating cockpit", + "project_1_boundary": "Project #1 is not an active reviewer route", + "project_metadata_boundary": "Project metadata is coordination only, not proof, approval, merge authority, runtime truth, signal truth, or public-safe status", + "rendering_boundary": "Website and GitHub rendering are not proof", + "proof_authority_repo": "hawkinsoperations-proof owns proof records and claim ceilings", + "command_center_proof_ceiling": "SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY", + "ledger_public_safe_status": "NOT_PUBLIC_SAFE", + "reviewer_metrics_pipeline": "Reviewer metrics pipeline keeps Lifetime Governed Cases separate from detection activity, validation cases, proof records, blocked claims, and Project Board reconciliation status", + "reviewer_metrics_counts": "Reviewer metrics values are authority-owned snapshots in proof/platform records; front-door text must route to those records instead of copying changing counts", + "ho_det_001_public_ceiling": "CONTROLLED_TEST_VALIDATED", + "runtime_signal_public_promotions": "runtime-active, signal-observed, evidence-linked public proof, public-safe, production-ready, fleet-wide, AWS-live, Cribl-routed, Wazuh-routed, autonomous SOC, AI-approved, AI-decided, analyst-approved, and live Splunk claims remain blocked unless separately proven and approved", + "standing_controls": ".github#8 and .github#10 remain standing controls", + "standing_control_replacement": "Closing or replacing .github#8 or .github#10 requires explicit Raylee approval that names the replacement standing-control role", +} REQUIRED_TEXT = { "README.md": [ @@ -160,8 +179,8 @@ def load_manifest(errors: list[str]) -> dict: return {} if manifest.get("schema") != "hawkinsoperations-command-center-invariants-v1": fail("manifest schema mismatch", errors) - if not isinstance(manifest.get("invariants"), dict): - fail("manifest invariants must be an object", errors) + if manifest.get("invariants") != EXPECTED_INVARIANTS: + fail("manifest invariants must match the exact reviewed authority contract", errors) return manifest From 700f486d6c215f7e5a26ede96c178a84612d237f Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:13:44 -0500 Subject: [PATCH 008/101] Restore Hoxline authority contract role --- governance/ORG_CI_CD_AUTHORITY_CONTRACT.md | 7 ++++--- scripts/verify-command-center-invariants.py | 14 ++++++++++++++ 2 files changed, 18 insertions(+), 3 deletions(-) diff --git a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md index fae5ba5..4f700cd 100644 --- a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md +++ b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md @@ -28,7 +28,7 @@ Docs and diagrams are routing material until backed by checks, required review, The organization-level governance ladder is: ```text -.github -> platform -> detections -> validation -> proof -> website +.github -> hoxline -> platform -> detections -> validation -> proof -> website ``` This ladder describes authority routing: @@ -36,6 +36,7 @@ This ladder describes authority routing: | Layer | Owner repo | Owns | Does not prove | | --- | --- | --- | --- | | Organization control plane | `.github` | Reviewer routing, CI/CD contract docs, required-check matrix, promotion ladder language. | Detection correctness, validation results, runtime state, signal observation, evidence linkage, public-safe status. | +| Product / ProofOps control plane | `hoxline` | Product control experience, bounded review routing, and Claim Authority capabilities such as Claim Firewall. | Proof records, runtime truth, signal truth, public-safe status, final approval, or merge authority. | | Runtime and agent boundary plane | `hawkinsoperations-platform` | Platform contracts, runtime/agent boundary schemas, status/plan visibility, private-review support lanes. | Detection source truth, validation pass/fail truth, public proof, production deployment, public-safe runtime evidence. | | Detection source plane | `hawkinsoperations-detections` | Detection source files, detection metadata, source status, blocked-claim source ceilings. | Controlled-test validation, runtime activity, signal observation, proof status, public-safe status. | | Validation behavior plane | `hawkinsoperations-validation` | Deterministic validators, fixtures, validation reports, claim-boundary scanners, report-only parity checks. | Runtime activity, signal observation, public proof, public-safe status, production coverage. | @@ -47,7 +48,7 @@ This ladder describes authority routing: The detection evidence chain is: ```text -.github policy -> detections source -> validation behavior -> platform visibility/runtime contracts -> proof ceiling -> website rendering +.github policy -> detections source -> validation behavior -> Hoxline ProofOps control -> platform visibility/runtime contracts -> proof ceiling -> website rendering ``` The chain separates two appearances of platform: @@ -57,7 +58,7 @@ The chain separates two appearances of platform: `.github` is governance and control-plane routing. It can say what the organization requires, where reviewers should look, and which checks should become authoritative. It is not proof truth. -Detection source can support `SOURCE_EXISTS`. Validation behavior can support controlled-test validation only when the validator, fixtures, and report exist and pass. Platform visibility can describe status and next gates without widening proof. Proof records authorize public claim ceilings. Website rendering only presents approved public state. +Detection source can support `SOURCE_EXISTS`. Validation behavior can support controlled-test validation only when the validator, fixtures, and report exist and pass. Hoxline can carry bounded control context and route claim evaluation without owning proof or approval. Platform visibility can describe status and next gates without widening proof. Proof records authorize public claim ceilings. Website rendering only presents approved public state. ## Current-State Notes diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 5fc596b..dd77c56 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -290,6 +290,20 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ("`hoxline`", "Product / ProofOps control", "Hoxline product surface and Claim Authority capabilities, starting with Claim Firewall.", "Product framing does not prove runtime, signal, evidence, public-safe status, production readiness, or approval."), ), ), + ( + "governance/ORG_CI_CD_AUTHORITY_CONTRACT.md", + "Repository Governance Ladder", + "| Layer | Owner repo | Owns | Does not prove |", + ( + ("Organization control plane", "`.github`", "Reviewer routing, CI/CD contract docs, required-check matrix, promotion ladder language.", "Detection correctness, validation results, runtime state, signal observation, evidence linkage, public-safe status."), + ("Product / ProofOps control plane", "`hoxline`", "Product control experience, bounded review routing, and Claim Authority capabilities such as Claim Firewall.", "Proof records, runtime truth, signal truth, public-safe status, final approval, or merge authority."), + ("Runtime and agent boundary plane", "`hawkinsoperations-platform`", "Platform contracts, runtime/agent boundary schemas, status/plan visibility, private-review support lanes.", "Detection source truth, validation pass/fail truth, public proof, production deployment, public-safe runtime evidence."), + ("Detection source plane", "`hawkinsoperations-detections`", "Detection source files, detection metadata, source status, blocked-claim source ceilings.", "Controlled-test validation, runtime activity, signal observation, proof status, public-safe status."), + ("Validation behavior plane", "`hawkinsoperations-validation`", "Deterministic validators, fixtures, validation reports, claim-boundary scanners, report-only parity checks.", "Runtime activity, signal observation, public proof, public-safe status, production coverage."), + ("Proof ceiling plane", "`hawkinsoperations-proof`", "Proof records, proof indexes, claim ceilings, public-proof linkage after review.", "Raw private evidence publication, runtime operation, website presentation."), + ("Public rendering plane", "`hawkinsoperations-website`", "Approved public rendering and reviewer routes to source, validation, and proof records.", "Proof by itself, runtime truth, signal truth, evidence truth, claim approval."), + ), + ), ) for rel, heading, expected_header, expected_rows in authority_tables: table_text = read_text(ROOT / rel, errors) From c64b0a6d8157917cfc7c20666e0bedf3d15198b1 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:17:39 -0500 Subject: [PATCH 009/101] Bind organization door table routes --- scripts/verify-command-center-invariants.py | 19 ++++++++++++++----- 1 file changed, 14 insertions(+), 5 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index dd77c56..768e396 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -225,11 +225,20 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: profile_text, re.DOTALL, ) - if not door_section or not re.search( - r"\*\*\[Website / Reviewer Guide\]\(https://hawkinsoperations\.com/\)\*\*", - door_section.group(1), - ): - fail("profile/README.md must bind the Website / Reviewer Guide door to the stable Website route", errors) + expected_door_lines = ( + "| If you want to... | Start here | What that surface does |", + "|---|---|---|", + "| Understand or present the complete system | **[Website / Reviewer Guide](https://hawkinsoperations.com/)** · [enter presentation mode](https://hawkinsoperations.com/?present=1&scene=1) | Visual walkthrough for a podcast, brown bag, show-and-tell, technical review, or self-guided inspection. Website rendering is not proof. |", + "| Explore the product | **[Hoxline](https://hawkinsoperations.com/hoxline/)** | ProofOps control for the AI security era: how AI-assisted work becomes tested, reviewed, blocked, or safe to claim. |", + "| Verify source and receipts | **[GitHub reviewer route](START_HERE.md)** | Source, deterministic validation, proof records, contracts, governance, and reproducible checks across seven authority repositories. GitHub rendering is not proof. |", + ) + actual_door_lines = () if not door_section else tuple( + line.strip() + for line in door_section.group(1).splitlines() + if line.strip().startswith("|") + ) + if actual_door_lines != expected_door_lines: + fail("profile/README.md must preserve the exact three-door routing table", errors) if "no eighth" not in profile: fail("profile/README.md missing no-eighth-repository boundary", errors) From b1db9e62003be5b1a2ee430ea37ed3518fdfc5d2 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:23:14 -0500 Subject: [PATCH 010/101] Reject alternate Markdown authority rows --- scripts/verify-command-center-invariants.py | 28 ++++++++++++++------- 1 file changed, 19 insertions(+), 9 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 768e396..9a14c9f 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -153,6 +153,21 @@ def read_text(path: Path, errors: list[str]) -> str: return path.read_text(encoding="utf-8") +def extract_contiguous_table_lines(section_text: str, expected_header: str) -> tuple[str, ...]: + """Return every contiguous pipe-delimited row beginning at an exact header.""" + section_lines = [line.strip() for line in section_text.splitlines()] + try: + header_index = section_lines.index(expected_header) + except ValueError: + return () + table_lines: list[str] = [] + for line in section_lines[header_index:]: + if not line or "|" not in line: + break + table_lines.append(line) + return tuple(table_lines) + + def iter_text_files() -> list[Path]: files: list[Path] = [] for scope in TEXT_SCOPES: @@ -232,10 +247,9 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: "| Explore the product | **[Hoxline](https://hawkinsoperations.com/hoxline/)** | ProofOps control for the AI security era: how AI-assisted work becomes tested, reviewed, blocked, or safe to claim. |", "| Verify source and receipts | **[GitHub reviewer route](START_HERE.md)** | Source, deterministic validation, proof records, contracts, governance, and reproducible checks across seven authority repositories. GitHub rendering is not proof. |", ) - actual_door_lines = () if not door_section else tuple( - line.strip() - for line in door_section.group(1).splitlines() - if line.strip().startswith("|") + actual_door_lines = () if not door_section else extract_contiguous_table_lines( + door_section.group(1), + expected_door_lines[0], ) if actual_door_lines != expected_door_lines: fail("profile/README.md must preserve the exact three-door routing table", errors) @@ -324,11 +338,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if not section_match: fail(f"{rel} missing parseable authority table: {heading}", errors) continue - table_lines = [ - line.strip() - for line in section_match.group(1).splitlines() - if line.strip().startswith("|") - ] + table_lines = extract_contiguous_table_lines(section_match.group(1), expected_header) if not table_lines or table_lines[0] != expected_header: fail(f"{rel} authority table must preserve its exact ownership-boundary headers", errors) continue From fceb6d4f42ef3671744cbaa1771cbfda836d64b4 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:30:56 -0500 Subject: [PATCH 011/101] Synchronize seven-repository governance routes --- .github/pull_request_template.md | 1 + governance/CROSS_REPO_PROMOTION_MAP.md | 3 + governance/ORG_REQUIRED_CHECKS_MATRIX.yml | 10 +-- governance/PROMOTION_LADDER_CONTRACT.yml | 39 ++++++++--- scripts/verify-command-center-invariants.py | 78 +++++++++++++++++++++ wiki/11_ORG_SYSTEM_MAP.md | 33 +++++---- 6 files changed, 134 insertions(+), 30 deletions(-) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 568c642..b005f04 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -38,6 +38,7 @@ Cross-repo work aligns by detection ID, artifact ID, proof gate, evidence refere - Current proof gate: - Downstream repos affected: - [ ] .github + - [ ] hoxline - [ ] hawkinsoperations-detections - [ ] hawkinsoperations-validation - [ ] hawkinsoperations-platform diff --git a/governance/CROSS_REPO_PROMOTION_MAP.md b/governance/CROSS_REPO_PROMOTION_MAP.md index ee664e9..3bbb2ca 100644 --- a/governance/CROSS_REPO_PROMOTION_MAP.md +++ b/governance/CROSS_REPO_PROMOTION_MAP.md @@ -23,6 +23,7 @@ Website/GitHub rendering is not proof. Public proof ceiling remains `CONTROLLED_ | Repository | Owns | Does not own | |---|---|---| | `.github` | Reviewer routing and claim-control expectations | Runtime truth, signal truth, proof approval, production status | +| `hoxline` | Product / ProofOps control experience and Claim Authority capabilities | Proof records, runtime truth, signal truth, final approval, merge authority | | `hawkinsoperations-detections` | Detection source truth | Validation result, runtime status, evidence approval, public-safe wording | | `hawkinsoperations-validation` | Test, fixture, verifier, and behavior truth | Production runtime, signal observation, public proof | | `hawkinsoperations-platform` | Runtime contracts and integration guardrails | Public-safe runtime proof, detection proof approval | @@ -37,6 +38,7 @@ Examples: - Detection source changes can trigger validation changes when tests, fixtures, schemas, or expected behavior must change. - Validation outcome changes can trigger proof changes when the claim ceiling, evidence record, or allowed wording changes. +- Hoxline control changes can trigger proof or website review when claim routing, blocked wording, or reviewer-facing ceilings would otherwise drift. - Platform contract changes can trigger proof changes when runtime guardrails affect claim boundaries. - Proof record changes can trigger website changes when public wording becomes newly allowed or newly blocked. - `.github` routing changes can trigger no downstream PR when they only improve navigation and do not alter source, validation, platform, proof, or public wording truth. @@ -46,6 +48,7 @@ Examples: | Changed repo | Check for downstream impact | Downstream PR required when | Valid no-op when | |---|---|---|---| | `.github` | Reviewer route, claim-control expectation, public boundary wording | It changes allowed public wording, proof expectations, or repo ownership boundaries | It only improves navigation, layout, or explanation without changing truth | +| `hoxline` | Product control flow, Claim Authority behavior, blocked wording, reviewer context | Proof records, public wording, or another owned truth surface must change to remain accurate | Product or UX changes preserve the same evidence ceilings and authority boundaries | | `detections` | Source logic, metadata, IDs, expected behavior | Tests, fixtures, proof records, or platform contracts must change to stay accurate | Source-only change does not affect validation, platform, proof, or website claims | | `validation` | Test result, verifier, fixture, schema, workflow behavior | Proof ceiling or evidence record must reflect a new validated boundary | Validation tooling changes do not alter recorded claim ceilings | | `platform` | Runtime contract, integration guardrail, deployment boundary | Proof records or website wording would otherwise overclaim runtime or signal status | Contract cleanup does not change public claim boundaries | diff --git a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml index fd273ef..7cde303 100644 --- a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml +++ b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml @@ -159,7 +159,7 @@ repos: verifier_command: "python scripts/verify-ho-det-001-proof-integrity.py; python scripts/verify_proof_integrity.py; python scripts/verify-proof-pack-001-release.py" trigger_path_filter_risk: "Observed pull_request and push triggers; proof checks prove only proof-record integrity and release-contract scope." report_only_versus_fail_closed_status: "Fail-closed only if required and only for exact proof integrity scope." - next_hardening_gate: "Add proof records/index entries for ID-DET-002/003/004 and HO-DET-012 before any website or public-proof wording claims parity." + next_hardening_gate: "Maintain proof-record/index integrity for ID-DET-002/003/004 and HO-DET-012; any stronger website wording still requires a separate proof-authority decision." - repo_name: "hawkinsoperations-website" truth_surface: "Public rendering of approved public state." required_checks_observed: @@ -177,17 +177,17 @@ repos: verifier_command: "npm run check:site; npm run build" trigger_path_filter_risk: "Observed pull_request and push triggers with no path filter; build can fail site violations but does not prove the rendered claims are true." report_only_versus_fail_closed_status: "Build/check can be fail-closed for website contract scope if required; rendering remains non-proof." - next_hardening_gate: "Add website routes only after proof records exist for ID-DET-002/003/004 and HO-DET-012 public routing is approved." + next_hardening_gate: "Dedicated identity routes for ID-DET-002/003/004 remain optional presentation work; HO-DET-012 already has a bounded summary, and no route may widen the recorded proof ceiling." current_gap_notes: id_det_002_003_004: source: "Detections PR #27 carried source." validation: "Validation PR #46 carried controlled-test validation." platform: "Platform PR #29 carried status/plan visibility." - proof: "Pending proof index and proof records." - website: "Pending public routes." + proof: "Proof records, proof cards, and proof-index entries exist at CONTROLLED_TEST_VALIDATED." + website: "Dedicated identity-specific presentation routes remain pending; owning source, validation, and proof routes are available." ho_det_012: source_validation_platform: "Source, validation, and platform progress exist." - proof_website: "Proof and website parity are still needed if public routing is desired." + proof_website: "Proof record, proof card, proof-index entry, and bounded website summary exist; runtime, signal, and public-safe promotion remain unproven." blocked_claims: - runtime-active public proof - signal-observed public proof diff --git a/governance/PROMOTION_LADDER_CONTRACT.yml b/governance/PROMOTION_LADDER_CONTRACT.yml index 896daa9..5750a42 100644 --- a/governance/PROMOTION_LADDER_CONTRACT.yml +++ b/governance/PROMOTION_LADDER_CONTRACT.yml @@ -43,8 +43,29 @@ layers: - REPORT_ONLY - HUMAN_REVIEW_REQUIRED human_review_requirement: true - - layer_name: "platform_runtime_agent_boundary" + - layer_name: "hoxline_proofops_control" ladder_position: 2 + owner_repo: "hoxline" + allowed_inherited_truth: + - "Bounded source, validation, and proof context routed for reviewer inspection." + - "Claim Authority decisions within configured evidence ceilings." + - "Claim Firewall enforcement receipts." + blocked_inherited_truth: + - "Product control creates proof records or final approval." + - "Hoxline establishes runtime-active or signal-observed truth." + - "Claim routing grants merge, disposition, public-safe, or case-closure authority." + required_promotion_gates: + - "Owning source, validation, platform, and proof records remain separate." + - "Claim decisions preserve the configured proof ceiling." + - "Human review remains required for approval, merge, or promotion." + status_values: + - SOURCE_EXISTS + - CONTROLLED_TEST_VALIDATED + - BLOCKED + - HUMAN_REVIEW_REQUIRED + human_review_requirement: true + - layer_name: "platform_runtime_agent_boundary" + ladder_position: 3 owner_repo: "hawkinsoperations-platform" allowed_inherited_truth: - "Detection IDs and bounded validation claims from detections/validation when referenced as inputs." @@ -68,7 +89,7 @@ layers: - HUMAN_REVIEW_REQUIRED human_review_requirement: true - layer_name: "detection_source" - ladder_position: 3 + ladder_position: 4 owner_repo: "hawkinsoperations-detections" allowed_inherited_truth: - "A detection source artifact exists when committed and reviewed." @@ -91,7 +112,7 @@ layers: - HUMAN_REVIEW_REQUIRED human_review_requirement: true - layer_name: "validation_behavior" - ladder_position: 4 + ladder_position: 5 owner_repo: "hawkinsoperations-validation" allowed_inherited_truth: - "Controlled fixture pass/fail results generated by deterministic validators." @@ -117,7 +138,7 @@ layers: - HUMAN_REVIEW_REQUIRED human_review_requirement: true - layer_name: "proof_ceiling" - ladder_position: 5 + ladder_position: 6 owner_repo: "hawkinsoperations-proof" allowed_inherited_truth: - "Reviewed source and validation facts linked to proof records." @@ -144,7 +165,7 @@ layers: - HUMAN_REVIEW_REQUIRED human_review_requirement: true - layer_name: "website_rendering" - ladder_position: 6 + ladder_position: 7 owner_repo: "hawkinsoperations-website" allowed_inherited_truth: - "Approved public wording from proof records." @@ -175,11 +196,13 @@ current_state_notes: detections_pr: 27 validation_pr: 46 platform_pr: 29 - proof_records: "pending" - website_routes: "pending" + proof_records: "Proof records, proof cards, and proof-index entries exist at the recorded CONTROLLED_TEST_VALIDATED ceiling." + website_routes: "Dedicated identity-specific presentation routes remain pending; source, validation, and proof records are already reviewer-accessible." ho_det_012: source_validation_platform_progress: true - proof_website_parity_needed_if_public_routing_desired: true + proof_record_card_and_index_present: true + bounded_website_summary_present: true + runtime_signal_and_public_safe_promotion: "not established" cross_repo_parity: current_status: REPORT_ONLY fail_closed_promotion_requires_separate_approval: true diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 9a14c9f..fc792ef 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -82,6 +82,20 @@ "NOT_PUBLIC_SAFE", "CONTROLLED_TEST_VALIDATED", ], + "governance/PROMOTION_LADDER_CONTRACT.yml": [ + "hoxline_proofops_control", + "Proof records, proof cards, and proof-index entries exist at the recorded CONTROLLED_TEST_VALIDATED ceiling.", + "proof_record_card_and_index_present: true", + ], + "governance/ORG_REQUIRED_CHECKS_MATRIX.yml": [ + "Proof records, proof cards, and proof-index entries exist at CONTROLLED_TEST_VALIDATED.", + "Proof record, proof card, proof-index entry, and bounded website summary exist", + ], + "wiki/11_ORG_SYSTEM_MAP.md": [ + "hoxline
product / ProofOps control", + "platform state manifest", + "This routing map deliberately does not copy changing counts.", + ], "governance/ISSUE_FACTORY_CONTROL_RECEIPTS.md": [ "#10", "#8", @@ -327,6 +341,20 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ("Public rendering plane", "`hawkinsoperations-website`", "Approved public rendering and reviewer routes to source, validation, and proof records.", "Proof by itself, runtime truth, signal truth, evidence truth, claim approval."), ), ), + ( + "governance/CROSS_REPO_PROMOTION_MAP.md", + "3. Truth Surface Map", + "| Repository | Owns | Does not own |", + ( + ("`.github`", "Reviewer routing and claim-control expectations", "Runtime truth, signal truth, proof approval, production status"), + ("`hoxline`", "Product / ProofOps control experience and Claim Authority capabilities", "Proof records, runtime truth, signal truth, final approval, merge authority"), + ("`hawkinsoperations-detections`", "Detection source truth", "Validation result, runtime status, evidence approval, public-safe wording"), + ("`hawkinsoperations-validation`", "Test, fixture, verifier, and behavior truth", "Production runtime, signal observation, public proof"), + ("`hawkinsoperations-platform`", "Runtime contracts and integration guardrails", "Public-safe runtime proof, detection proof approval"), + ("`hawkinsoperations-proof`", "Evidence records and claim ceilings", "Source ownership for other repos, raw private evidence publication"), + ("`hawkinsoperations-website`", "Public rendering only after proof allows wording", "Source truth, runtime truth, signal truth, evidence truth"), + ), + ), ) for rel, heading, expected_header, expected_rows in authority_tables: table_text = read_text(ROOT / rel, errors) @@ -359,6 +387,56 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if actual_rows != expected_rows: fail(f"{rel} authority table must contain only the exact seven repository ownership rows", errors) + promotion_text = read_text(ROOT / "governance" / "PROMOTION_LADDER_CONTRACT.yml", errors) + promotion_owners = tuple(re.findall(r'^\s+owner_repo:\s+"([^"]+)"', promotion_text, re.MULTILINE)) + expected_promotion_owners = ( + ".github", + "hoxline", + "hawkinsoperations-platform", + "hawkinsoperations-detections", + "hawkinsoperations-validation", + "hawkinsoperations-proof", + "hawkinsoperations-website", + ) + if promotion_owners != expected_promotion_owners: + fail("promotion ladder must contain the exact seven repository owners in governed order", errors) + + template_text = read_text(ROOT / ".github" / "pull_request_template.md", errors) + downstream_section = re.search( + r"- Downstream repos affected:\s+(.*?)(?=\n- Downstream action:)", + template_text, + re.DOTALL, + ) + expected_downstream_repos = ( + ".github", + "hoxline", + "hawkinsoperations-detections", + "hawkinsoperations-validation", + "hawkinsoperations-platform", + "hawkinsoperations-proof", + "hawkinsoperations-website", + "None", + ) + actual_downstream_repos = () if not downstream_section else tuple( + re.findall(r"^[ \t]*- \[ \] (.+)$", downstream_section.group(1), re.MULTILINE) + ) + if actual_downstream_repos != expected_downstream_repos: + fail("pull request template must enumerate exactly seven downstream repositories plus None", errors) + + system_map_text = read_text(ROOT / "wiki" / "11_ORG_SYSTEM_MAP.md", errors) + required_hoxline_routes = ( + 'hox["hoxline
product / ProofOps control', + "org --> hox", + "val --> hox", + "hox --> proof", + "validation --> hoxline --> proof", + ) + for route in required_hoxline_routes: + if route not in system_map_text: + fail(f"wiki/11_ORG_SYSTEM_MAP.md missing Hoxline routing: {route}", errors) + if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): + fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) + def check_project_boundaries(all_text: str, errors: list[str]) -> None: required = [ diff --git a/wiki/11_ORG_SYSTEM_MAP.md b/wiki/11_ORG_SYSTEM_MAP.md index 8d80e71..a935007 100644 --- a/wiki/11_ORG_SYSTEM_MAP.md +++ b/wiki/11_ORG_SYSTEM_MAP.md @@ -24,6 +24,7 @@ HawkinsOperations separates source, validation, runtime, signal, evidence, publi ```mermaid flowchart LR org[".github
org framing
sanitized governance summaries
reviewer routing"] + hox["hoxline
product / ProofOps control
Claim Authority capabilities
not proof authority"] det["hawkinsoperations-detections
detection source only"] val["hawkinsoperations-validation
tests / schemas / validation checks only"] plat["hawkinsoperations-platform
platform architecture
stack truth tracking
runtime boundary docs"] @@ -32,6 +33,7 @@ flowchart LR project["Private org control board
operating cockpit
work coordination only"] org --> det + org --> hox org --> val org --> plat org --> proof @@ -39,8 +41,9 @@ flowchart LR org --> project det --> val - val --> proof - plat --> proof + val --> hox + plat --> hox + hox --> proof proof --> web web -. "Warning: website does not prove runtime" .-> proof @@ -178,6 +181,7 @@ flowchart TD authority["Repo Authority Map"] source["Detection source"] validation["Validation artifacts"] + hoxline["Hoxline product / ProofOps control"] proof["Proof record"] project["Private org control board operating cockpit"] ledger["Lifetime Case Ledger public summary"] @@ -185,7 +189,7 @@ flowchart TD boundaries["Claim boundaries"] warning["Warning: website is last-mile rendering, not proof"] - profile --> start --> map --> authority --> source --> validation --> proof --> ledger --> website --> boundaries + profile --> start --> map --> authority --> source --> validation --> hoxline --> proof --> ledger --> website --> boundaries start --> project project -. "coordination only" .-> boundaries website -.-> warning @@ -205,20 +209,14 @@ flowchart TD ## Current Ledger Status -The proof-owned Lifetime Case Ledger public summary is a bounded count route, not runtime truth, signal truth, or public proof. +Current ledger values are owned by the [platform state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json). The [proof-owned public summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-public-summary.json) is a bounded historical snapshot and may lag the platform-owned state. This routing map deliberately does not copy changing counts. -| Field | Current source-controlled value | -| --- | --- | -| Summary route | `hawkinsoperations-proof/proof/records/lifetime-case-ledger-v1-public-summary.json` | -| Total ledger events | 4 | -| Total cases | 4 | -| Public-safe count | 0 | -| Closed-case count | 0 | -| Appended detections | `HO-DET-001`, `HO-DET-011`, `HO-DET-012` | -| Public-safe boundary | `NOT_PUBLIC_SAFE` | -| Proof ceiling | `SCHEMA_CONTRACT_VERIFIER_EXISTS_ONLY` | +| Surface | Reviewer route | Boundary | +| --- | --- | --- | +| Current source-controlled ledger state | [Platform state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) | Platform source state only; not runtime truth, signal truth, public proof, or case closure authority. | +| Bounded public snapshot | [Proof-owned public summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-public-summary.json) | Historical bounded summary; it does not override a newer platform manifest or promote proof. | -The ledger summary does not prove live runtime activity, signal observation, production deployment, SOCaaS availability, public-safe runtime proof, public proof, autonomous SOC authority, AI-approved final disposition, analyst-approved final disposition, or case closure authority. +Neither route proves live runtime activity, signal observation, production deployment, SOCaaS availability, public-safe runtime proof, public proof, autonomous SOC authority, AI-approved final disposition, analyst-approved final disposition, or case closure authority. ## Current Org State Summary @@ -231,7 +229,7 @@ The `Claim blocked` column is blocked wording from `governance/CONTROL_STATUS_MA | Repo authority map | Soft enforcement | The map defines repository ownership boundaries. | Blocked wording: the map proves a repo complied. | | Website | Rendering only | Website content is rendering only. | Blocked wording: website presentation proves source, runtime, signal, or evidence truth. | | Project operating cockpit | COORDINATION_ONLY | The canonical private HawkinsOperations Control Board routes current work visibility and review context through private Project #2; Project #1 is not an active reviewer route. | Blocked wording: project board state proves source, runtime, signal, evidence, public proof, public-safe status, merge authority, or approval. | -| Lifetime Case Ledger public summary | BOUNDED_COUNT_ROUTE | The proof-owned summary records 4 ledger events, 4 cases, 0 public-safe cases, and 0 closed cases. | Blocked wording: ledger counts prove runtime, signal, public proof, public-safe status, case closure, or disposition authority. | +| Lifetime Case Ledger routes | SOURCE_ROUTED_NO_COPIED_COUNTS | The platform manifest owns current source-controlled state; the proof summary remains a bounded historical snapshot. | Blocked wording: copied or historical counts prove current runtime, signal, public proof, public-safe status, case closure, or disposition authority. | | HO-DET-001 source | SATISFIED | HO-DET-001 source exists. | Blocked wording: HO-DET-001 is production-ready, fleet-wide, public-safe, or deployed. | | HO-DET-001 Splunk source | SATISFIED | HO-DET-001 Splunk source exists. | Blocked wording: Live Splunk fired as public proof. | | HO-DET-001 controlled-test validation | SATISFIED | HO-DET-001 passed controlled-test validation against controlled positive and negative process-creation fixtures. | Blocked wording: HO-DET-001 is production-ready, fleet-wide, public-safe, or catches attacks in production. | @@ -251,5 +249,6 @@ The `Claim blocked` column is blocked wording from `governance/CONTROL_STATUS_MA - [Control status matrix](../governance/CONTROL_STATUS_MATRIX.md) - [Repository authority map](../architecture/REPO_AUTHORITY_MAP.md) - [Project operating cockpit](https://github.com/orgs/HawkinsOperations/projects/2) -- [Lifetime Case Ledger public summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-public-summary.json) +- [Lifetime Case Ledger platform state manifest](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/lifetime-case-ledger-v1-state-manifest.json) +- [Lifetime Case Ledger bounded public summary](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/lifetime-case-ledger-v1-public-summary.json) - [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) From b03c6a2118fef8af07324a02c8f062915c1604e1 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:36:47 -0500 Subject: [PATCH 012/101] Validate Hoxline governance gates --- governance/ORG_REQUIRED_CHECKS_MATRIX.yml | 15 ++++++++++ scripts/verify-command-center-invariants.py | 33 +++++++++++++++++++++ 2 files changed, 48 insertions(+) diff --git a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml index 7cde303..d09b0a1 100644 --- a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml +++ b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml @@ -38,6 +38,21 @@ repos: trigger_path_filter_risk: "Path-filtered to command-center route, governance, architecture, wiki, PR-template, workflow, manifest, and verifier changes. It does not run for unrelated assets." report_only_versus_fail_closed_status: "workflow-control only unless the check is required by branch protection or ruleset and fails closed on violation." next_hardening_gate: "Make command-center-invariants required only after separate GitHub settings/ruleset approval." + - repo_name: "hoxline" + truth_surface: "Product / ProofOps control experience and Claim Authority capabilities." + required_checks_observed: [] + important_non_required_checks: + - "ci / hoxline-trust-boundaries is observed in repository workflow source; this matrix does not assert that GitHub settings make it required." + workflow_file: + - ".github/workflows/ci.yml" + job_check_context: + - workflow_name: "ci" + job_id: "hoxline-trust-boundaries" + job_display_name: null + verifier_command: "python -B -m compileall src tests; python -B -m unittest discover -s tests; python -B -m pytest; Hoxline Gauntlet and Claim Firewall checks from workflow source" + trigger_path_filter_risk: "Observed pull_request and push triggers with no path filter; the job verifies checked product/control contracts but does not create proof, runtime truth, signal truth, or approval." + report_only_versus_fail_closed_status: "Repository CI source is present; fail-closed merge enforcement exists only if this job is required by separately governed GitHub settings." + next_hardening_gate: "Keep product-control checks aligned with proof ceilings and preserve human authority; any ruleset change requires separate GitHub settings approval." - repo_name: "hawkinsoperations-detections" truth_surface: "Detection source truth." required_checks_observed: diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index fc792ef..2a9460d 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -40,6 +40,27 @@ "standing_controls": ".github#8 and .github#10 remain standing controls", "standing_control_replacement": "Closing or replacing .github#8 or .github#10 requires explicit Raylee approval that names the replacement standing-control role", } +EXPECTED_HOXLINE_PROMOTION_LAYER = ''' - layer_name: "hoxline_proofops_control" + ladder_position: 2 + owner_repo: "hoxline" + allowed_inherited_truth: + - "Bounded source, validation, and proof context routed for reviewer inspection." + - "Claim Authority decisions within configured evidence ceilings." + - "Claim Firewall enforcement receipts." + blocked_inherited_truth: + - "Product control creates proof records or final approval." + - "Hoxline establishes runtime-active or signal-observed truth." + - "Claim routing grants merge, disposition, public-safe, or case-closure authority." + required_promotion_gates: + - "Owning source, validation, platform, and proof records remain separate." + - "Claim decisions preserve the configured proof ceiling." + - "Human review remains required for approval, merge, or promotion." + status_values: + - SOURCE_EXISTS + - CONTROLLED_TEST_VALIDATED + - BLOCKED + - HUMAN_REVIEW_REQUIRED + human_review_requirement: true''' REQUIRED_TEXT = { "README.md": [ @@ -400,6 +421,18 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ) if promotion_owners != expected_promotion_owners: fail("promotion ladder must contain the exact seven repository owners in governed order", errors) + hoxline_layer = re.search( + r'^ - layer_name: "hoxline_proofops_control"\n.*?(?=\n - layer_name:)', + promotion_text, + re.MULTILINE | re.DOTALL, + ) + if not hoxline_layer or hoxline_layer.group(0).strip() != EXPECTED_HOXLINE_PROMOTION_LAYER.strip(): + fail("Hoxline promotion layer must preserve its exact position, boundaries, gates, statuses, and human-review requirement", errors) + + required_checks_text = read_text(ROOT / "governance" / "ORG_REQUIRED_CHECKS_MATRIX.yml", errors) + required_checks_repos = tuple(re.findall(r'^\s+- repo_name:\s+"([^"]+)"', required_checks_text, re.MULTILINE)) + if len(required_checks_repos) != len(SYSTEM_REPOSITORIES) or set(required_checks_repos) != set(SYSTEM_REPOSITORIES): + fail("required-checks matrix must contain each of the exact seven repositories once", errors) template_text = read_text(ROOT / ".github" / "pull_request_template.md", errors) downstream_section = re.search( From f6366aa2ebbe41d912f4bd2c38d1fa54d1dfc3dd Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:41:43 -0500 Subject: [PATCH 013/101] Bind required checks to repository owners --- scripts/verify-command-center-invariants.py | 44 ++++++++++++++++++++- 1 file changed, 42 insertions(+), 2 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 2a9460d..5b71177 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -430,9 +430,49 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: fail("Hoxline promotion layer must preserve its exact position, boundaries, gates, statuses, and human-review requirement", errors) required_checks_text = read_text(ROOT / "governance" / "ORG_REQUIRED_CHECKS_MATRIX.yml", errors) - required_checks_repos = tuple(re.findall(r'^\s+- repo_name:\s+"([^"]+)"', required_checks_text, re.MULTILINE)) - if len(required_checks_repos) != len(SYSTEM_REPOSITORIES) or set(required_checks_repos) != set(SYSTEM_REPOSITORIES): + required_checks_matches = re.findall( + r'^ - repo_name:\s+"([^"]+)"\n(.*?)(?=^ - repo_name:|^current_gap_notes:)', + required_checks_text, + re.MULTILINE | re.DOTALL, + ) + required_checks_blocks = {repository: block for repository, block in required_checks_matches} + if len(required_checks_matches) != len(SYSTEM_REPOSITORIES) or set(required_checks_blocks) != set(SYSTEM_REPOSITORIES): fail("required-checks matrix must contain each of the exact seven repositories once", errors) + expected_required_check_markers = { + ".github": ( + 'truth_surface: "Organization control-plane routing and reviewer entry point."', + '.github/workflows/command-center-invariants.yml', + ), + "hoxline": ( + 'truth_surface: "Product / ProofOps control experience and Claim Authority capabilities."', + '.github/workflows/ci.yml', + 'job_id: "hoxline-trust-boundaries"', + ), + "hawkinsoperations-detections": ( + 'truth_surface: "Detection source truth."', + '.github/workflows/baseline-detection-contract.yml', + ), + "hawkinsoperations-validation": ( + 'truth_surface: "Validation behavior, fixtures, reports, and claim-boundary scan truth."', + '.github/workflows/baseline-validation-contract.yml', + ), + "hawkinsoperations-platform": ( + 'truth_surface: "Platform runtime/agent boundary contracts and status/plan visibility."', + '.github/workflows/local-gpu-triage-gate.yml', + ), + "hawkinsoperations-proof": ( + 'truth_surface: "Proof records, proof indexes, claim ceilings, and public-proof linkage."', + '.github/workflows/baseline-proof-integrity.yml', + ), + "hawkinsoperations-website": ( + 'truth_surface: "Public rendering of approved public state."', + 'job_id: "build"', + ), + } + for repository, markers in expected_required_check_markers.items(): + block = required_checks_blocks.get(repository, "") + if any(marker not in block for marker in markers): + fail(f"required-checks matrix metadata is not bound to {repository}", errors) template_text = read_text(ROOT / ".github" / "pull_request_template.md", errors) downstream_section = re.search( From 83ce7a6a0573444d2c10153947bad2a2b055abb9 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:49:34 -0500 Subject: [PATCH 014/101] Parse governance contracts structurally --- .../workflows/command-center-invariants.yml | 3 + scripts/verify-command-center-invariants.py | 148 +++++++++++------- 2 files changed, 96 insertions(+), 55 deletions(-) diff --git a/.github/workflows/command-center-invariants.yml b/.github/workflows/command-center-invariants.yml index 9e2db4b..eb7c006 100644 --- a/.github/workflows/command-center-invariants.yml +++ b/.github/workflows/command-center-invariants.yml @@ -34,5 +34,8 @@ jobs: - name: Checkout uses: actions/checkout@v4 + - name: Install structural YAML verifier dependency + run: python -m pip install --disable-pip-version-check PyYAML==6.0.2 + - name: Verify command-center invariants run: python scripts/verify-command-center-invariants.py diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 5b71177..44fa2c7 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -8,6 +8,8 @@ import sys from pathlib import Path +import yaml + ROOT = Path(__file__).resolve().parents[1] MANIFEST_PATH = ROOT / "governance" / "COMMAND_CENTER_INVARIANTS.json" @@ -40,27 +42,33 @@ "standing_controls": ".github#8 and .github#10 remain standing controls", "standing_control_replacement": "Closing or replacing .github#8 or .github#10 requires explicit Raylee approval that names the replacement standing-control role", } -EXPECTED_HOXLINE_PROMOTION_LAYER = ''' - layer_name: "hoxline_proofops_control" - ladder_position: 2 - owner_repo: "hoxline" - allowed_inherited_truth: - - "Bounded source, validation, and proof context routed for reviewer inspection." - - "Claim Authority decisions within configured evidence ceilings." - - "Claim Firewall enforcement receipts." - blocked_inherited_truth: - - "Product control creates proof records or final approval." - - "Hoxline establishes runtime-active or signal-observed truth." - - "Claim routing grants merge, disposition, public-safe, or case-closure authority." - required_promotion_gates: - - "Owning source, validation, platform, and proof records remain separate." - - "Claim decisions preserve the configured proof ceiling." - - "Human review remains required for approval, merge, or promotion." - status_values: - - SOURCE_EXISTS - - CONTROLLED_TEST_VALIDATED - - BLOCKED - - HUMAN_REVIEW_REQUIRED - human_review_requirement: true''' +EXPECTED_HOXLINE_PROMOTION_LAYER = { + "layer_name": "hoxline_proofops_control", + "ladder_position": 2, + "owner_repo": "hoxline", + "allowed_inherited_truth": [ + "Bounded source, validation, and proof context routed for reviewer inspection.", + "Claim Authority decisions within configured evidence ceilings.", + "Claim Firewall enforcement receipts.", + ], + "blocked_inherited_truth": [ + "Product control creates proof records or final approval.", + "Hoxline establishes runtime-active or signal-observed truth.", + "Claim routing grants merge, disposition, public-safe, or case-closure authority.", + ], + "required_promotion_gates": [ + "Owning source, validation, platform, and proof records remain separate.", + "Claim decisions preserve the configured proof ceiling.", + "Human review remains required for approval, merge, or promotion.", + ], + "status_values": [ + "SOURCE_EXISTS", + "CONTROLLED_TEST_VALIDATED", + "BLOCKED", + "HUMAN_REVIEW_REQUIRED", + ], + "human_review_requirement": True, +} REQUIRED_TEXT = { "README.md": [ @@ -188,6 +196,21 @@ def read_text(path: Path, errors: list[str]) -> str: return path.read_text(encoding="utf-8") +def read_yaml_mapping(path: Path, errors: list[str]) -> dict: + text = read_text(path, errors) + if not text: + return {} + try: + document = yaml.safe_load(text) + except yaml.YAMLError as exc: + fail(f"{path.relative_to(ROOT).as_posix()} YAML parse failed: {exc}", errors) + return {} + if not isinstance(document, dict): + fail(f"{path.relative_to(ROOT).as_posix()} must contain a YAML mapping", errors) + return {} + return document + + def extract_contiguous_table_lines(section_text: str, expected_header: str) -> tuple[str, ...]: """Return every contiguous pipe-delimited row beginning at an exact header.""" section_lines = [line.strip() for line in section_text.splitlines()] @@ -408,8 +431,12 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if actual_rows != expected_rows: fail(f"{rel} authority table must contain only the exact seven repository ownership rows", errors) - promotion_text = read_text(ROOT / "governance" / "PROMOTION_LADDER_CONTRACT.yml", errors) - promotion_owners = tuple(re.findall(r'^\s+owner_repo:\s+"([^"]+)"', promotion_text, re.MULTILINE)) + promotion_document = read_yaml_mapping(ROOT / "governance" / "PROMOTION_LADDER_CONTRACT.yml", errors) + promotion_layers = promotion_document.get("layers", []) + if not isinstance(promotion_layers, list) or any(not isinstance(layer, dict) for layer in promotion_layers): + fail("promotion ladder layers must be a YAML list of mappings", errors) + promotion_layers = [] + promotion_owners = tuple(layer.get("owner_repo") for layer in promotion_layers) expected_promotion_owners = ( ".github", "hoxline", @@ -421,57 +448,68 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ) if promotion_owners != expected_promotion_owners: fail("promotion ladder must contain the exact seven repository owners in governed order", errors) - hoxline_layer = re.search( - r'^ - layer_name: "hoxline_proofops_control"\n.*?(?=\n - layer_name:)', - promotion_text, - re.MULTILINE | re.DOTALL, - ) - if not hoxline_layer or hoxline_layer.group(0).strip() != EXPECTED_HOXLINE_PROMOTION_LAYER.strip(): + hoxline_layers = [layer for layer in promotion_layers if layer.get("owner_repo") == "hoxline"] + if len(hoxline_layers) != 1 or hoxline_layers[0] != EXPECTED_HOXLINE_PROMOTION_LAYER: fail("Hoxline promotion layer must preserve its exact position, boundaries, gates, statuses, and human-review requirement", errors) - required_checks_text = read_text(ROOT / "governance" / "ORG_REQUIRED_CHECKS_MATRIX.yml", errors) - required_checks_matches = re.findall( - r'^ - repo_name:\s+"([^"]+)"\n(.*?)(?=^ - repo_name:|^current_gap_notes:)', - required_checks_text, - re.MULTILINE | re.DOTALL, - ) - required_checks_blocks = {repository: block for repository, block in required_checks_matches} - if len(required_checks_matches) != len(SYSTEM_REPOSITORIES) or set(required_checks_blocks) != set(SYSTEM_REPOSITORIES): + required_checks_document = read_yaml_mapping(ROOT / "governance" / "ORG_REQUIRED_CHECKS_MATRIX.yml", errors) + required_checks_repos = required_checks_document.get("repos", []) + if not isinstance(required_checks_repos, list) or any(not isinstance(repo, dict) for repo in required_checks_repos): + fail("required-checks repos must be a YAML list of mappings", errors) + required_checks_repos = [] + required_checks_blocks = {repo.get("repo_name"): repo for repo in required_checks_repos} + if len(required_checks_repos) != len(SYSTEM_REPOSITORIES) or set(required_checks_blocks) != set(SYSTEM_REPOSITORIES): fail("required-checks matrix must contain each of the exact seven repositories once", errors) expected_required_check_markers = { ".github": ( - 'truth_surface: "Organization control-plane routing and reviewer entry point."', - '.github/workflows/command-center-invariants.yml', + "Organization control-plane routing and reviewer entry point.", + ".github/workflows/command-center-invariants.yml", + "command-center-invariants", ), "hoxline": ( - 'truth_surface: "Product / ProofOps control experience and Claim Authority capabilities."', - '.github/workflows/ci.yml', - 'job_id: "hoxline-trust-boundaries"', + "Product / ProofOps control experience and Claim Authority capabilities.", + ".github/workflows/ci.yml", + "hoxline-trust-boundaries", ), "hawkinsoperations-detections": ( - 'truth_surface: "Detection source truth."', - '.github/workflows/baseline-detection-contract.yml', + "Detection source truth.", + ".github/workflows/baseline-detection-contract.yml", + "baseline-hero-artifact-contract", ), "hawkinsoperations-validation": ( - 'truth_surface: "Validation behavior, fixtures, reports, and claim-boundary scan truth."', - '.github/workflows/baseline-validation-contract.yml', + "Validation behavior, fixtures, reports, and claim-boundary scan truth.", + ".github/workflows/baseline-validation-contract.yml", + "baseline-hero-validation-contract", ), "hawkinsoperations-platform": ( - 'truth_surface: "Platform runtime/agent boundary contracts and status/plan visibility."', - '.github/workflows/local-gpu-triage-gate.yml', + "Platform runtime/agent boundary contracts and status/plan visibility.", + ".github/workflows/local-gpu-triage-gate.yml", + "local-gpu-triage-status", ), "hawkinsoperations-proof": ( - 'truth_surface: "Proof records, proof indexes, claim ceilings, and public-proof linkage."', - '.github/workflows/baseline-proof-integrity.yml', + "Proof records, proof indexes, claim ceilings, and public-proof linkage.", + ".github/workflows/baseline-proof-integrity.yml", + "baseline-hod001-proof-integrity", ), "hawkinsoperations-website": ( - 'truth_surface: "Public rendering of approved public state."', - 'job_id: "build"', + "Public rendering of approved public state.", + ".github/workflows/governance-gate.yml", + "build", ), } - for repository, markers in expected_required_check_markers.items(): - block = required_checks_blocks.get(repository, "") - if any(marker not in block for marker in markers): + for repository, (truth_surface, workflow_file, job_id) in expected_required_check_markers.items(): + block = required_checks_blocks.get(repository, {}) + workflow_files = block.get("workflow_file", []) if isinstance(block, dict) else [] + job_contexts = block.get("job_check_context", []) if isinstance(block, dict) else [] + observed_job_ids = { + context.get("job_id") for context in job_contexts if isinstance(context, dict) + } if isinstance(job_contexts, list) else set() + if ( + block.get("truth_surface") != truth_surface + or not isinstance(workflow_files, list) + or workflow_file not in workflow_files + or job_id not in observed_job_ids + ): fail(f"required-checks matrix metadata is not bound to {repository}", errors) template_text = read_text(ROOT / ".github" / "pull_request_template.md", errors) From aa1519dbc7e3769136bbf6f6d74a12dc1a26a453 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:53:29 -0500 Subject: [PATCH 015/101] Document invariant verifier dependency --- architecture/REPRODUCIBLE_REVIEWER_PATH.md | 1 + profile/START_HERE.md | 1 + 2 files changed, 2 insertions(+) diff --git a/architecture/REPRODUCIBLE_REVIEWER_PATH.md b/architecture/REPRODUCIBLE_REVIEWER_PATH.md index f1c46a1..ed7f7f3 100644 --- a/architecture/REPRODUCIBLE_REVIEWER_PATH.md +++ b/architecture/REPRODUCIBLE_REVIEWER_PATH.md @@ -190,6 +190,7 @@ The `.github` command-center route has a local invariant verifier for reviewer-r ```powershell cd ..\.github $env:PYTHONDONTWRITEBYTECODE = "1" +python -m pip install --disable-pip-version-check PyYAML==6.0.2 python -B scripts\verify-command-center-invariants.py ``` diff --git a/profile/START_HERE.md b/profile/START_HERE.md index 1679d7d..70aa2d8 100644 --- a/profile/START_HERE.md +++ b/profile/START_HERE.md @@ -53,6 +53,7 @@ Continue from the Hoxline repository by returning to the sibling organization re ```powershell cd ..\.github $env:PYTHONDONTWRITEBYTECODE = "1" +python -m pip install --disable-pip-version-check PyYAML==6.0.2 python -B scripts/verify-command-center-invariants.py ``` From c87de0f0a514a6a6d836b3eb33758fabedab305b Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 17:58:14 -0500 Subject: [PATCH 016/101] Preserve Hoxline evidence handoff order --- scripts/verify-command-center-invariants.py | 5 ++++- wiki/11_ORG_SYSTEM_MAP.md | 4 ++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 44fa2c7..edb778a 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -539,12 +539,15 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: 'hox["hoxline
product / ProofOps control', "org --> hox", "val --> hox", - "hox --> proof", + "hox --> plat", + "plat --> proof", "validation --> hoxline --> proof", ) for route in required_hoxline_routes: if route not in system_map_text: fail(f"wiki/11_ORG_SYSTEM_MAP.md missing Hoxline routing: {route}", errors) + if "plat --> hox" in system_map_text: + fail("wiki/11_ORG_SYSTEM_MAP.md must not route platform backward through Hoxline", errors) if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) diff --git a/wiki/11_ORG_SYSTEM_MAP.md b/wiki/11_ORG_SYSTEM_MAP.md index a935007..6eedc6b 100644 --- a/wiki/11_ORG_SYSTEM_MAP.md +++ b/wiki/11_ORG_SYSTEM_MAP.md @@ -42,8 +42,8 @@ flowchart LR det --> val val --> hox - plat --> hox - hox --> proof + hox --> plat + plat --> proof proof --> web web -. "Warning: website does not prove runtime" .-> proof From affab68cf384b4697c709588211d63de8e6d222b Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:02:13 -0500 Subject: [PATCH 017/101] Fail closed on authority contract ambiguity --- scripts/verify-command-center-invariants.py | 44 ++++++++++++++++++++- wiki/11_ORG_SYSTEM_MAP.md | 3 +- 2 files changed, 44 insertions(+), 3 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index edb778a..f7d2ccf 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -185,6 +185,44 @@ ) +class UniqueKeySafeLoader(yaml.SafeLoader): + """Safe YAML loader that rejects ambiguous duplicate mapping keys.""" + + +def construct_unique_mapping( + loader: UniqueKeySafeLoader, + node: yaml.MappingNode, + deep: bool = False, +) -> dict: + mapping: dict = {} + for key_node, value_node in node.value: + key = loader.construct_object(key_node, deep=deep) + try: + duplicate = key in mapping + except TypeError as exc: + raise yaml.constructor.ConstructorError( + "while constructing a mapping", + node.start_mark, + "found an unhashable mapping key", + key_node.start_mark, + ) from exc + if duplicate: + raise yaml.constructor.ConstructorError( + "while constructing a mapping", + node.start_mark, + f"found duplicate key ({key!r})", + key_node.start_mark, + ) + mapping[key] = loader.construct_object(value_node, deep=deep) + return mapping + + +UniqueKeySafeLoader.add_constructor( + yaml.resolver.BaseResolver.DEFAULT_MAPPING_TAG, + construct_unique_mapping, +) + + def fail(message: str, errors: list[str]) -> None: errors.append(message) @@ -201,7 +239,7 @@ def read_yaml_mapping(path: Path, errors: list[str]) -> dict: if not text: return {} try: - document = yaml.safe_load(text) + document = yaml.load(text, Loader=UniqueKeySafeLoader) except yaml.YAMLError as exc: fail(f"{path.relative_to(ROOT).as_posix()} YAML parse failed: {exc}", errors) return {} @@ -541,13 +579,15 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: "val --> hox", "hox --> plat", "plat --> proof", - "validation --> hoxline --> proof", + "validation --> hoxline --> platform --> proof", ) for route in required_hoxline_routes: if route not in system_map_text: fail(f"wiki/11_ORG_SYSTEM_MAP.md missing Hoxline routing: {route}", errors) if "plat --> hox" in system_map_text: fail("wiki/11_ORG_SYSTEM_MAP.md must not route platform backward through Hoxline", errors) + if re.search(r"\bhox(?:line)? --> proof\b", system_map_text): + fail("wiki/11_ORG_SYSTEM_MAP.md must not bypass platform between Hoxline and proof", errors) if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) diff --git a/wiki/11_ORG_SYSTEM_MAP.md b/wiki/11_ORG_SYSTEM_MAP.md index 6eedc6b..c2bde16 100644 --- a/wiki/11_ORG_SYSTEM_MAP.md +++ b/wiki/11_ORG_SYSTEM_MAP.md @@ -182,6 +182,7 @@ flowchart TD source["Detection source"] validation["Validation artifacts"] hoxline["Hoxline product / ProofOps control"] + platform["Platform contracts / status visibility"] proof["Proof record"] project["Private org control board operating cockpit"] ledger["Lifetime Case Ledger public summary"] @@ -189,7 +190,7 @@ flowchart TD boundaries["Claim boundaries"] warning["Warning: website is last-mile rendering, not proof"] - profile --> start --> map --> authority --> source --> validation --> hoxline --> proof --> ledger --> website --> boundaries + profile --> start --> map --> authority --> source --> validation --> hoxline --> platform --> proof --> ledger --> website --> boundaries start --> project project -. "coordination only" .-> boundaries website -.-> warning From fd6813c6f96d6a0882808eb48a4af23e206c4de0 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:03:42 -0500 Subject: [PATCH 018/101] Bind organization reviewer contexts --- architecture/REPRODUCIBLE_REVIEWER_PATH.md | 2 +- scripts/verify-command-center-invariants.py | 17 +++++++++++++---- 2 files changed, 14 insertions(+), 5 deletions(-) diff --git a/architecture/REPRODUCIBLE_REVIEWER_PATH.md b/architecture/REPRODUCIBLE_REVIEWER_PATH.md index ed7f7f3..839d773 100644 --- a/architecture/REPRODUCIBLE_REVIEWER_PATH.md +++ b/architecture/REPRODUCIBLE_REVIEWER_PATH.md @@ -165,7 +165,7 @@ npm run build Expected Phase 1 gap: - ID-DET-002, ID-DET-003, and ID-DET-004 public website routes are pending. -- HO-DET-012 appears in current website source data, but proof and website parity remain required before any public proof or public-safe wording can be claimed. +- HO-DET-012 appears in current website source data with its proof record, proof card, indexed `CONTROLLED_TEST_VALIDATED` ceiling, and bounded website summary present; runtime, signal, and public-safe promotion remain separately gated. - Inspect the [Website Reviewer Guide](https://hawkinsoperations.com/) in ordinary and presentation modes as rendering QA only; visual success does not promote source, validation, runtime, signal, or proof status. ## Private-Only Commands Excluded diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index f7d2ccf..6517498 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -503,50 +503,59 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: "Organization control-plane routing and reviewer entry point.", ".github/workflows/command-center-invariants.yml", "command-center-invariants", + "command-center-invariants", ), "hoxline": ( "Product / ProofOps control experience and Claim Authority capabilities.", ".github/workflows/ci.yml", + "ci", "hoxline-trust-boundaries", ), "hawkinsoperations-detections": ( "Detection source truth.", ".github/workflows/baseline-detection-contract.yml", + "baseline-detection-contract", "baseline-hero-artifact-contract", ), "hawkinsoperations-validation": ( "Validation behavior, fixtures, reports, and claim-boundary scan truth.", ".github/workflows/baseline-validation-contract.yml", + "baseline-validation-contract", "baseline-hero-validation-contract", ), "hawkinsoperations-platform": ( "Platform runtime/agent boundary contracts and status/plan visibility.", ".github/workflows/local-gpu-triage-gate.yml", + "Local GPU Triage Gate", "local-gpu-triage-status", ), "hawkinsoperations-proof": ( "Proof records, proof indexes, claim ceilings, and public-proof linkage.", ".github/workflows/baseline-proof-integrity.yml", + "baseline-proof-integrity", "baseline-hod001-proof-integrity", ), "hawkinsoperations-website": ( "Public rendering of approved public state.", ".github/workflows/governance-gate.yml", + "Governance Gate", "build", ), } - for repository, (truth_surface, workflow_file, job_id) in expected_required_check_markers.items(): + for repository, (truth_surface, workflow_file, workflow_name, job_id) in expected_required_check_markers.items(): block = required_checks_blocks.get(repository, {}) workflow_files = block.get("workflow_file", []) if isinstance(block, dict) else [] job_contexts = block.get("job_check_context", []) if isinstance(block, dict) else [] - observed_job_ids = { - context.get("job_id") for context in job_contexts if isinstance(context, dict) + observed_workflow_jobs = { + (context.get("workflow_name"), context.get("job_id")) + for context in job_contexts + if isinstance(context, dict) } if isinstance(job_contexts, list) else set() if ( block.get("truth_surface") != truth_surface or not isinstance(workflow_files, list) or workflow_file not in workflow_files - or job_id not in observed_job_ids + or (workflow_name, job_id) not in observed_workflow_jobs ): fail(f"required-checks matrix metadata is not bound to {repository}", errors) From 3fe5f700f616ba78421fe4c14e2dbbd646dd79ef Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:08:48 -0500 Subject: [PATCH 019/101] Bind Hoxline checks to current main --- governance/ORG_REQUIRED_CHECKS_MATRIX.yml | 6 +++--- scripts/verify-command-center-invariants.py | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml index d09b0a1..1b0d1b5 100644 --- a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml +++ b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml @@ -42,14 +42,14 @@ repos: truth_surface: "Product / ProofOps control experience and Claim Authority capabilities." required_checks_observed: [] important_non_required_checks: - - "ci / hoxline-trust-boundaries is observed in repository workflow source; this matrix does not assert that GitHub settings make it required." + - "ci / test is observed on the current hoxline main workflow source; this matrix does not assert that GitHub settings make it required." workflow_file: - ".github/workflows/ci.yml" job_check_context: - workflow_name: "ci" - job_id: "hoxline-trust-boundaries" + job_id: "test" job_display_name: null - verifier_command: "python -B -m compileall src tests; python -B -m unittest discover -s tests; python -B -m pytest; Hoxline Gauntlet and Claim Firewall checks from workflow source" + verifier_command: "python -m pytest; Claim Firewall pass/fail and safe-context examples; JSON finding validation; legacy-name scan" trigger_path_filter_risk: "Observed pull_request and push triggers with no path filter; the job verifies checked product/control contracts but does not create proof, runtime truth, signal truth, or approval." report_only_versus_fail_closed_status: "Repository CI source is present; fail-closed merge enforcement exists only if this job is required by separately governed GitHub settings." next_hardening_gate: "Keep product-control checks aligned with proof ceilings and preserve human authority; any ruleset change requires separate GitHub settings approval." diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 6517498..14b8d86 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -509,7 +509,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: "Product / ProofOps control experience and Claim Authority capabilities.", ".github/workflows/ci.yml", "ci", - "hoxline-trust-boundaries", + "test", ), "hawkinsoperations-detections": ( "Detection source truth.", From e33adcf9c3602723bf6d3d1a56eb2611e90102e4 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:09:43 -0500 Subject: [PATCH 020/101] Require human review across promotion layers --- scripts/verify-command-center-invariants.py | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 14b8d86..0817510 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -486,6 +486,17 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ) if promotion_owners != expected_promotion_owners: fail("promotion ladder must contain the exact seven repository owners in governed order", errors) + non_human_review_layers = [ + layer.get("owner_repo") + for layer in promotion_layers + if layer.get("human_review_requirement") is not True + ] + if non_human_review_layers: + fail( + "every promotion layer must preserve human_review_requirement: true; " + f"invalid layers: {non_human_review_layers}", + errors, + ) hoxline_layers = [layer for layer in promotion_layers if layer.get("owner_repo") == "hoxline"] if len(hoxline_layers) != 1 or hoxline_layers[0] != EXPECTED_HOXLINE_PROMOTION_LAYER: fail("Hoxline promotion layer must preserve its exact position, boundaries, gates, statuses, and human-review requirement", errors) From ba261569e8a800ff8232c4998cb0d54833d5004f Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:14:56 -0500 Subject: [PATCH 021/101] Complete required-check context bindings --- governance/ORG_REQUIRED_CHECKS_MATRIX.yml | 20 ++++++++++++++- scripts/verify-command-center-invariants.py | 28 +++++++++++++++++++-- 2 files changed, 45 insertions(+), 3 deletions(-) diff --git a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml index 1b0d1b5..345dae9 100644 --- a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml +++ b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml @@ -27,7 +27,7 @@ repos: truth_surface: "Organization control-plane routing and reviewer entry point." required_checks_observed: [] important_non_required_checks: - - "command-center-invariants workflow exists as a repo-local verifier route, but it is not proven required by branch protection or ruleset in this file." + - "command-center-invariants / command-center-invariants exists as a repo-local verifier route, but it is not proven required by branch protection or ruleset in this file." workflow_file: - ".github/workflows/command-center-invariants.yml" job_check_context: @@ -122,6 +122,21 @@ repos: - workflow_name: "HO-DET-001 Proof Loop" job_id: "ho-det-001-proof-loop" verifier_command: "python scripts/validate-ho-det-001.py plus proof-loop boundary and parity commands" + - workflow_name: "Governance Gate" + job_id: "required-files" + verifier_command: "repository required-file checks" + - workflow_name: "Public HO-DET-001 Controlled-Test Report" + job_id: "public-ho-det-001-controlled-test-report" + verifier_command: "python scripts/validate-ho-det-001.py; python scripts/verify-ho-det-001-result-parity.py; python scripts/scan-ho-det-001-claim-boundaries.py" + - workflow_name: "AWS-DET-001 Fixture Loop" + job_id: "aws-det-001-fixture-loop" + verifier_command: "python scripts/validate-aws-det-001.py; python scripts/verify-aws-det-001-result-parity.py; python scripts/scan-aws-det-001-claim-boundaries.py; python scripts/verify-proof-record-parity.py" + - workflow_name: "HO-DET-011 Fixture Loop" + job_id: "ho-det-011-fixture-loop" + verifier_command: "python scripts/validate-ho-det-011.py; python scripts/verify-ho-det-011-result-parity.py; python scripts/scan-ho-det-011-claim-boundaries.py" + - workflow_name: "security-onion-visibility-contract" + job_id: "security-onion-visibility-contract" + verifier_command: "python3 ./scripts/verify-security-onion-visibility-rollup.py; python3 ./scripts/verify-security-onion-cross-source-corroboration.py" trigger_path_filter_risk: "Phase 2A removed fragile pull_request and push path filters from the baseline validation contract workflow so baseline-hero-validation-contract appears on every validation PR and main push. Several fixture loops may still use path filters, so they remain package/lane scoped." report_only_versus_fail_closed_status: "baseline-hero-validation-contract is a real control for the validation registry/package scope when required and passing. Cross-repo parity remains report-only." next_hardening_gate: "proof status index" @@ -172,6 +187,9 @@ repos: - workflow_name: "Proof Pack 001 Release Check" job_id: "proof-pack-001-release-check" verifier_command: "python scripts/verify-ho-det-001-proof-integrity.py; python scripts/verify_proof_integrity.py; python scripts/verify-proof-pack-001-release.py" + - workflow_name: "Governance Gate" + job_id: "required-files" + verifier_command: "repository required-file checks" trigger_path_filter_risk: "Observed pull_request and push triggers; proof checks prove only proof-record integrity and release-contract scope." report_only_versus_fail_closed_status: "Fail-closed only if required and only for exact proof integrity scope." next_hardening_gate: "Maintain proof-record/index integrity for ID-DET-002/003/004 and HO-DET-012; any stronger website wording still requires a separate proof-authority decision." diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 0817510..f697432 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -557,11 +557,13 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: block = required_checks_blocks.get(repository, {}) workflow_files = block.get("workflow_file", []) if isinstance(block, dict) else [] job_contexts = block.get("job_check_context", []) if isinstance(block, dict) else [] + if not isinstance(job_contexts, list) or any(not isinstance(context, dict) for context in job_contexts): + fail(f"{repository} job_check_context must be a list of mappings", errors) + job_contexts = [] observed_workflow_jobs = { (context.get("workflow_name"), context.get("job_id")) for context in job_contexts - if isinstance(context, dict) - } if isinstance(job_contexts, list) else set() + } if ( block.get("truth_surface") != truth_surface or not isinstance(workflow_files, list) @@ -569,6 +571,28 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: or (workflow_name, job_id) not in observed_workflow_jobs ): fail(f"required-checks matrix metadata is not bound to {repository}", errors) + declared_pairs: list[tuple[str, str]] = [] + for declaration_field in ("required_checks_observed", "important_non_required_checks"): + declarations = block.get(declaration_field, []) if isinstance(block, dict) else [] + if not isinstance(declarations, list) or any(not isinstance(item, str) for item in declarations): + fail(f"{repository} {declaration_field} must be a list of workflow / job strings", errors) + continue + for declaration in declarations: + match = re.match(r"^(.+?) / ([A-Za-z0-9_.-]+)(?:\s|$)", declaration) + if not match: + fail(f"{repository} {declaration_field} has an unparseable workflow / job declaration", errors) + continue + declared_pairs.append((match.group(1), match.group(2))) + if len(declared_pairs) != len(set(declared_pairs)): + fail(f"{repository} check declarations contain duplicate workflow / job pairs", errors) + actual_pairs = [ + (context.get("workflow_name"), context.get("job_id")) + for context in job_contexts + ] + if len(actual_pairs) != len(set(actual_pairs)): + fail(f"{repository} job_check_context contains duplicate workflow / job pairs", errors) + if set(actual_pairs) != set(declared_pairs): + fail(f"{repository} declared checks and structured workflow / job contexts must match exactly", errors) template_text = read_text(ROOT / ".github" / "pull_request_template.md", errors) downstream_section = re.search( From 52d04730b038d55772273c628ea37dc9f45b0a79 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:15:52 -0500 Subject: [PATCH 022/101] Fingerprint the complete promotion contract --- scripts/verify-command-center-invariants.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index f697432..5a1ce12 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -3,6 +3,7 @@ from __future__ import annotations +import hashlib import json import re import sys @@ -23,6 +24,9 @@ "hawkinsoperations-proof", "hawkinsoperations-website", ) +# Fingerprint of the complete reviewed seven-layer mapping. Any field, list item, +# gate, status, boundary, or order change requires an intentional verifier update. +EXPECTED_PROMOTION_LAYERS_SHA256 = "4001c331113644ae97beb78e0fc355c84164e4e1bf5d48c7e628ec21496e2785" EXPECTED_INVARIANTS = { "github_repo_role": ".github is reviewer routing and governance shell only", "presentation_route": "hawkinsoperations.com is the Website Reviewer Guide and presentation surface", @@ -474,6 +478,15 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if not isinstance(promotion_layers, list) or any(not isinstance(layer, dict) for layer in promotion_layers): fail("promotion ladder layers must be a YAML list of mappings", errors) promotion_layers = [] + promotion_layers_payload = json.dumps( + promotion_layers, + sort_keys=True, + separators=(",", ":"), + ensure_ascii=False, + ).encode("utf-8") + promotion_layers_fingerprint = hashlib.sha256(promotion_layers_payload).hexdigest() + if promotion_layers_fingerprint != EXPECTED_PROMOTION_LAYERS_SHA256: + fail("promotion ladder complete seven-layer contract does not match the reviewed mapping", errors) promotion_owners = tuple(layer.get("owner_repo") for layer in promotion_layers) expected_promotion_owners = ( ".github", From 645fc51e1f70b740f5824feddf86bff297efa105 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:22:02 -0500 Subject: [PATCH 023/101] Reconcile invariant enforcement phase --- architecture/REPRODUCIBLE_REVIEWER_PATH.md | 4 ++-- governance/ORG_CI_CD_AUTHORITY_CONTRACT.md | 18 +++++++++++++----- governance/PROMOTION_LADDER_CONTRACT.yml | 2 +- scripts/verify-command-center-invariants.py | 17 +++++++++-------- 4 files changed, 25 insertions(+), 16 deletions(-) diff --git a/architecture/REPRODUCIBLE_REVIEWER_PATH.md b/architecture/REPRODUCIBLE_REVIEWER_PATH.md index 839d773..0cb00e4 100644 --- a/architecture/REPRODUCIBLE_REVIEWER_PATH.md +++ b/architecture/REPRODUCIBLE_REVIEWER_PATH.md @@ -1,6 +1,6 @@ # Reproducible Reviewer Path -Status: PHASE_1_DOCUMENTED_CONTRACT_ONLY +Status: PHASE_2B_REVIEWER_PATH_WITH_LOCAL_INVARIANT_CHECK Control type: reviewer reproduction path Trust class: SOURCE_EXISTS after merge @@ -162,7 +162,7 @@ npm run public-status:verify npm run build ``` -Expected Phase 1 gap: +Current presentation gap: - ID-DET-002, ID-DET-003, and ID-DET-004 public website routes are pending. - HO-DET-012 appears in current website source data with its proof record, proof card, indexed `CONTROLLED_TEST_VALIDATED` ceiling, and bounded website summary present; runtime, signal, and public-safe promotion remain separately gated. diff --git a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md index 4f700cd..3c6c613 100644 --- a/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md +++ b/governance/ORG_CI_CD_AUTHORITY_CONTRACT.md @@ -1,12 +1,12 @@ # Organization CI/CD Authority Contract -Status: PHASE_1_DOCUMENTED_CONTRACT_ONLY -Control type: org-level CI/CD authority routing +Status: PHASE_2B_ORG_INVARIANT_WORKFLOW_ACTIVE +Control type: org-level CI/CD authority routing / repo-local invariant enforcement Trust class: SOURCE_EXISTS after merge ## Purpose -This contract documents how the HawkinsOperations organization treats `.github` as the CI/CD control-plane contract and reviewer entry point. Phase 1 is documentation only. +This contract documents how the HawkinsOperations organization treats `.github` as the CI/CD control-plane contract and reviewer entry point. The existing repo-local `command-center-invariants` workflow now checks the declared routing and authority contract on scoped changes. This file does not create reusable workflows, change branch protection, change rulesets, prove runtime state, publish evidence, promote proof, or make anything public-safe. @@ -62,7 +62,7 @@ Detection source can support `SOURCE_EXISTS`. Validation behavior can support co ## Current-State Notes -These notes are recorded for Phase 1 routing. They do not promote any repository or detection beyond the proof records and checks that actually exist. +These notes are recorded for current reviewer routing. They do not promote any repository or detection beyond the proof records and checks that actually exist. - A historical mission audit reported its then-scoped repository set as clean, synced, and carrying zero open PRs. Treat that as historical audit context, not proof of current or future state; the current HawkinsOperations authority model contains exactly seven repositories. - Detections PR #27 carried ID-DET-002, ID-DET-003, and ID-DET-004 source. @@ -97,7 +97,13 @@ This is `VALIDATION_REGISTRY_ENFORCED` and `CHECK_ENFORCED_FOR_VALIDATION_REGIST The next gate is the proof status index because proof records, not validation checks, authorize public claim ceilings. The control plane should next record which validation-backed detections have proof-index support and which remain `NOT_PUBLIC_SAFE`. -## Phase 1 Boundary +## Phase 2B Organization Invariant Enforcement + +Phase 2B updates the existing repo-local `.github/workflows/command-center-invariants.yml` workflow only to install its pinned structural YAML dependency and run the command-center verifier on scoped organization-contract changes. + +This establishes a checked repository-local routing and authority contract for its declared files. It does not make the workflow reusable across repositories, change GitHub settings, make the check required by branch protection or rulesets, dispatch workflows, publish evidence, promote proof, create runtime or signal truth, authorize a merge, or replace human review. + +## Original Phase 1 Boundary Phase 1 may document: @@ -118,6 +124,8 @@ Phase 1 may not: - change website content - claim runtime-active, signal-observed, production-ready, or fleet-wide status +Phase 2B narrowly supersedes only the original prohibition on editing `.github/workflows` for the existing repo-local `command-center-invariants` workflow described above. Every other Phase 1 exclusion remains in force unless separately approved. + ## Blocked Claims The organization-level control plane must not claim: diff --git a/governance/PROMOTION_LADDER_CONTRACT.yml b/governance/PROMOTION_LADDER_CONTRACT.yml index 5750a42..dc117f8 100644 --- a/governance/PROMOTION_LADDER_CONTRACT.yml +++ b/governance/PROMOTION_LADDER_CONTRACT.yml @@ -1,5 +1,5 @@ schema_version: 1 -status: PHASE_1_DOCUMENTED_CONTRACT_ONLY +status: PHASE_2B_ORG_INVARIANT_ENFORCED control_type: promotion_ladder_contract authority_statement: "Human review remains promotion authority. Green CI is not authority. Codex is AI labor, not human governance." global_status_values: diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 5a1ce12..a9ef110 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -24,9 +24,10 @@ "hawkinsoperations-proof", "hawkinsoperations-website", ) -# Fingerprint of the complete reviewed seven-layer mapping. Any field, list item, -# gate, status, boundary, or order change requires an intentional verifier update. -EXPECTED_PROMOTION_LAYERS_SHA256 = "4001c331113644ae97beb78e0fc355c84164e4e1bf5d48c7e628ec21496e2785" +# Fingerprint of the complete reviewed promotion contract. Any layer, top-level +# gate, blocked claim, status, or current-state change requires an intentional +# verifier update. +EXPECTED_PROMOTION_CONTRACT_SHA256 = "65522c07b7e2983379dcb3ea1ba5b4cd03ccb3e5116983931bb8c3e23b36c7c8" EXPECTED_INVARIANTS = { "github_repo_role": ".github is reviewer routing and governance shell only", "presentation_route": "hawkinsoperations.com is the Website Reviewer Guide and presentation surface", @@ -478,15 +479,15 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if not isinstance(promotion_layers, list) or any(not isinstance(layer, dict) for layer in promotion_layers): fail("promotion ladder layers must be a YAML list of mappings", errors) promotion_layers = [] - promotion_layers_payload = json.dumps( - promotion_layers, + promotion_contract_payload = json.dumps( + promotion_document, sort_keys=True, separators=(",", ":"), ensure_ascii=False, ).encode("utf-8") - promotion_layers_fingerprint = hashlib.sha256(promotion_layers_payload).hexdigest() - if promotion_layers_fingerprint != EXPECTED_PROMOTION_LAYERS_SHA256: - fail("promotion ladder complete seven-layer contract does not match the reviewed mapping", errors) + promotion_contract_fingerprint = hashlib.sha256(promotion_contract_payload).hexdigest() + if promotion_contract_fingerprint != EXPECTED_PROMOTION_CONTRACT_SHA256: + fail("complete promotion contract does not match the reviewed machine-readable mapping", errors) promotion_owners = tuple(layer.get("owner_repo") for layer in promotion_layers) expected_promotion_owners = ( ".github", From 99c915ae70332fc61dc64adb76d0227daa309183 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:25:53 -0500 Subject: [PATCH 024/101] Align required-checks phase state --- governance/ORG_REQUIRED_CHECKS_MATRIX.yml | 4 ++-- scripts/verify-command-center-invariants.py | 13 +++++++++++++ 2 files changed, 15 insertions(+), 2 deletions(-) diff --git a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml index 345dae9..8699b67 100644 --- a/governance/ORG_REQUIRED_CHECKS_MATRIX.yml +++ b/governance/ORG_REQUIRED_CHECKS_MATRIX.yml @@ -1,7 +1,7 @@ schema_version: 1 -status: PHASE_2A_VALIDATION_ENFORCEMENT_RECORDED +status: PHASE_2B_ORG_INVARIANT_AND_VALIDATION_ENFORCEMENT_RECORDED control_type: org_required_checks_matrix -phase_1_boundary: +phase_2b_boundary: creates_reusable_workflows: false changes_github_settings: false changes_branch_protection: false diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index a9ef110..a4ee1bb 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -516,6 +516,19 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: fail("Hoxline promotion layer must preserve its exact position, boundaries, gates, statuses, and human-review requirement", errors) required_checks_document = read_yaml_mapping(ROOT / "governance" / "ORG_REQUIRED_CHECKS_MATRIX.yml", errors) + if required_checks_document.get("status") != "PHASE_2B_ORG_INVARIANT_AND_VALIDATION_ENFORCEMENT_RECORDED": + fail("required-checks matrix must preserve the current Phase 2B status", errors) + expected_phase_2b_boundary = { + "creates_reusable_workflows": False, + "changes_github_settings": False, + "changes_branch_protection": False, + "changes_rulesets": False, + "dispatches_workflows": False, + "promotes_proof": False, + "promotes_public_safe": False, + } + if required_checks_document.get("phase_2b_boundary") != expected_phase_2b_boundary: + fail("required-checks matrix must preserve the exact Phase 2B authority boundary", errors) required_checks_repos = required_checks_document.get("repos", []) if not isinstance(required_checks_repos, list) or any(not isinstance(repo, dict) for repo in required_checks_repos): fail("required-checks repos must be a YAML list of mappings", errors) From 6760c57f95291280d788437f47071cbf3b9daaf1 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:33:18 -0500 Subject: [PATCH 025/101] Enforce governed reviewer handoffs --- profile/README.md | 12 ++-- profile/START_HERE.md | 15 ++-- scripts/verify-command-center-invariants.py | 76 ++++++++++++++++++--- 3 files changed, 81 insertions(+), 22 deletions(-) diff --git a/profile/README.md b/profile/README.md index b7de448..9a134e0 100644 --- a/profile/README.md +++ b/profile/README.md @@ -31,8 +31,8 @@ Hoxline doctrine: AI is not the authority. Evidence is. | Time | Route | Outcome | |---:|---|---| | **30 seconds** | [Open the Reviewer Guide](https://hawkinsoperations.com/) → [open Hoxline](https://hawkinsoperations.com/hoxline/) → [inspect HO-DET-001 proof](https://hawkinsoperations.com/proof/ho-det-001/) → [map repository authority](../architecture/REPO_AUTHORITY_MAP.md) | Understand the system, the product control surface, one bounded proof route, and which repository owns each truth. | -| **3 minutes** | Follow [source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001) → [controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md) → [proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) → [Claim Firewall](https://hawkinsoperations.com/claim-firewall/) | See how one detection moves through separate truth surfaces while unsupported wording stays blocked. | -| **10 minutes** | Use the [focused runnable path](START_HERE.md#10-minute-reviewer-path) | Run Hoxline's local fixture-based demo, then inspect the HO-DET-001 source, validation, proof, and claim boundary. | +| **3 minutes** | Follow [source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001) → [controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md) → [Hoxline](https://hawkinsoperations.com/hoxline/) and [Claim Firewall](https://hawkinsoperations.com/claim-firewall/) → [platform contract](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/examples/ho-det-001-runtime-contract.sample.json) → [proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) | See how one detection moves through separate truth surfaces while unsupported wording stays blocked. | +| **10 minutes** | Use the [focused runnable path](START_HERE.md#10-minute-reviewer-path) | Run Hoxline's local fixture-based demo, then inspect the HO-DET-001 source, validation, product control, platform contract, proof, and claim boundary. | | **Extended** | Use the [Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md) | Clone all seven repositories and run their public checks without private runtime access. | ## The system in one route @@ -75,9 +75,11 @@ HO-DET-001 is a PowerShell EncodedCommand detection example. It is useful becaus 1. [Detection source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001) records the rule, query, metadata, and event-field expectations. 2. [Controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md) checks expected matches and known non-matches with deterministic fixtures. -3. [Proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) states the supported claim and the evidence ceiling. -4. [Proof Pack 001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) packages a bounded reviewer route with a verifier and release receipt. -5. [Website proof route](https://hawkinsoperations.com/proof/ho-det-001/) renders the reviewed boundary and routes back to its owners. +3. [Hoxline](https://hawkinsoperations.com/hoxline/) carries bounded control context, and [Claim Firewall](https://hawkinsoperations.com/claim-firewall/) demonstrates unsupported wording being blocked without creating proof. +4. [Platform contract example](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/examples/ho-det-001-runtime-contract.sample.json) shows the non-promotional handoff shape; it is not runtime evidence. +5. [Proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md) states the supported claim and the evidence ceiling. +6. [Proof Pack 001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001) packages a bounded reviewer route with a verifier and release receipt. +7. [Website proof route](https://hawkinsoperations.com/proof/ho-det-001/) renders the reviewed boundary and routes back to its owners. The current public ceiling for this example is `CONTROLLED_TEST_VALIDATED`. Controlled validation is evidence for the tested fixture scope; it is not automatic production truth. diff --git a/profile/START_HERE.md b/profile/START_HERE.md index 70aa2d8..dc89763 100644 --- a/profile/START_HERE.md +++ b/profile/START_HERE.md @@ -25,12 +25,13 @@ Follow one detection across its owners: 1. **View source:** [HO-DET-001 detection package](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001). 2. **View validation:** [controlled validation result](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md). -3. **View proof:** [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md). -4. **View the packaged receipt:** [Proof Pack 001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001). -5. **Inspect claim enforcement:** [Claim Firewall](https://hawkinsoperations.com/claim-firewall/). -6. **Confirm the ceiling:** [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md). +3. **Inspect product control:** [Hoxline](https://hawkinsoperations.com/hoxline/) and its [Claim Firewall](https://hawkinsoperations.com/claim-firewall/) capability. +4. **Inspect the platform handoff:** [bounded HO-DET-001 contract example](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/examples/ho-det-001-runtime-contract.sample.json). +5. **View proof:** [HO-DET-001 proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md). +6. **View the packaged receipt:** [Proof Pack 001](https://github.com/HawkinsOperations/hawkinsoperations-proof/releases/tag/hawkinsoperations-proof-pack-001). +7. **Confirm the ceiling:** [Control Status Matrix](../governance/CONTROL_STATUS_MATRIX.md). -Outcome: source, validation, proof, product control, and rendering remain inspectable without being treated as interchangeable authority. +Outcome: source, validation, product control, platform contracts, proof, and rendering remain inspectable without being treated as interchangeable authority. ## 10-minute reviewer path @@ -44,7 +45,7 @@ $env:PYTHONDONTWRITEBYTECODE = "1" python -B -m hoxline demo quickstart ``` -Then compare the generated reviewer artifacts with the [HO-DET-001 source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001), [controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md), and [proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md). The demo is local and fixture-based; it does not establish live runtime, signal, production, public-safe, or disposition truth. +Then compare the generated reviewer artifacts with the [HO-DET-001 source](https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001), [controlled validation](https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md), [Hoxline control surface](https://hawkinsoperations.com/hoxline/), [platform contract example](https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/examples/ho-det-001-runtime-contract.sample.json), and [proof record](https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md). The demo is local and fixture-based; it does not establish live runtime, signal, production, public-safe, or disposition truth. For the full seven-repository sweep, continue with the [extended Reproducible Reviewer Path](../architecture/REPRODUCIBLE_REVIEWER_PATH.md). @@ -89,7 +90,7 @@ Hoxline carries this boundary through the review loop. Claim Firewall is one Hox ## The current bounded example -HO-DET-001 has source artifacts, platform-specific query source, controlled positive and negative fixtures, deterministic validation output, and a proof record. Its current public ceiling is `CONTROLLED_TEST_VALIDATED`. +HO-DET-001 has source artifacts, platform-specific query source, controlled positive and negative fixtures, deterministic validation output, a Hoxline control route, a bounded platform contract example, and a proof record. Its current public ceiling is `CONTROLLED_TEST_VALIDATED`. That ceiling supports only the stated controlled-test scope. Runtime-active public proof, signal-observed public proof, production readiness, customer deployment, fleet-wide coverage, SOCaaS operation, autonomous SOC behavior, AI-approved disposition, analyst-approved disposition, public-safe runtime evidence, and case closure remain unproven here. diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index a4ee1bb..a7d084d 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -354,6 +354,33 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ) if actual_door_lines != expected_door_lines: fail("profile/README.md must preserve the exact three-door routing table", errors) + governed_route_markers = ( + "https://github.com/HawkinsOperations/hawkinsoperations-detections/tree/main/detections/successor/ho-det-001", + "https://github.com/HawkinsOperations/hawkinsoperations-validation/blob/main/reports/ho-det-001/validation-result.md", + "https://hawkinsoperations.com/hoxline/", + "https://hawkinsoperations.com/claim-firewall/", + "https://github.com/HawkinsOperations/hawkinsoperations-platform/blob/main/contracts/examples/ho-det-001-runtime-contract.sample.json", + "https://github.com/HawkinsOperations/hawkinsoperations-proof/blob/main/proof/records/HO-DET-001.md", + ) + profile_fast_path = re.search( + r"^\| \*\*3 minutes\*\* \| (.+)$", + profile_text, + re.MULTILINE, + ) + start_here_text = read_text(ROOT / "profile" / "START_HERE.md", errors) + start_here_fast_path = re.search( + r"## 3-minute command-center path\s+(.*?)(?=\n## |\Z)", + start_here_text, + re.DOTALL, + ) + for route_name, route_section in ( + ("profile/README.md fast reviewer path", profile_fast_path), + ("profile/START_HERE.md 3-minute path", start_here_fast_path), + ): + route_text = "" if route_section is None else route_section.group(1) + positions = tuple(route_text.find(marker) for marker in governed_route_markers) + if any(position < 0 for position in positions) or positions != tuple(sorted(positions)): + fail(f"{route_name} must preserve source -> validation -> Hoxline -> Claim Firewall -> platform -> proof order", errors) if "no eighth" not in profile: fail("profile/README.md missing no-eighth-repository boundary", errors) @@ -539,48 +566,70 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: expected_required_check_markers = { ".github": ( "Organization control-plane routing and reviewer entry point.", - ".github/workflows/command-center-invariants.yml", + (".github/workflows/command-center-invariants.yml",), "command-center-invariants", "command-center-invariants", ), "hoxline": ( "Product / ProofOps control experience and Claim Authority capabilities.", - ".github/workflows/ci.yml", + (".github/workflows/ci.yml",), "ci", "test", ), "hawkinsoperations-detections": ( "Detection source truth.", - ".github/workflows/baseline-detection-contract.yml", + ( + ".github/workflows/baseline-detection-contract.yml", + ".github/workflows/governance-gate.yml", + ), "baseline-detection-contract", "baseline-hero-artifact-contract", ), "hawkinsoperations-validation": ( "Validation behavior, fixtures, reports, and claim-boundary scan truth.", - ".github/workflows/baseline-validation-contract.yml", + ( + ".github/workflows/baseline-validation-contract.yml", + ".github/workflows/governance-gate.yml", + ".github/workflows/ho-det-012-fixture-loop.yml", + ".github/workflows/id-det-001-fixture-loop.yml", + ".github/workflows/ho-det-001-proof-loop.yml", + ".github/workflows/public-ho-det-001-report.yml", + ".github/workflows/aws-det-001-fixture-loop.yml", + ".github/workflows/ho-det-011-fixture-loop.yml", + ".github/workflows/security-onion-visibility-contract.yml", + ".github/workflows/cross-repo-claim-parity.yml", + ), "baseline-validation-contract", "baseline-hero-validation-contract", ), "hawkinsoperations-platform": ( "Platform runtime/agent boundary contracts and status/plan visibility.", - ".github/workflows/local-gpu-triage-gate.yml", + ( + ".github/workflows/governance-gate.yml", + ".github/workflows/local-gpu-triage-gate.yml", + ), "Local GPU Triage Gate", "local-gpu-triage-status", ), "hawkinsoperations-proof": ( "Proof records, proof indexes, claim ceilings, and public-proof linkage.", - ".github/workflows/baseline-proof-integrity.yml", + ( + ".github/workflows/baseline-proof-integrity.yml", + ".github/workflows/governance-gate.yml", + ".github/workflows/ho-det-001-proof-integrity.yml", + ".github/workflows/publish-proof-release.yml", + ), "baseline-proof-integrity", "baseline-hod001-proof-integrity", ), "hawkinsoperations-website": ( "Public rendering of approved public state.", - ".github/workflows/governance-gate.yml", + (".github/workflows/governance-gate.yml",), "Governance Gate", "build", ), } - for repository, (truth_surface, workflow_file, workflow_name, job_id) in expected_required_check_markers.items(): + for repository, (truth_surface, expected_workflow_files, workflow_name, job_id) in expected_required_check_markers.items(): block = required_checks_blocks.get(repository, {}) workflow_files = block.get("workflow_file", []) if isinstance(block, dict) else [] job_contexts = block.get("job_check_context", []) if isinstance(block, dict) else [] @@ -594,7 +643,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if ( block.get("truth_surface") != truth_surface or not isinstance(workflow_files, list) - or workflow_file not in workflow_files + or tuple(workflow_files) != expected_workflow_files or (workflow_name, job_id) not in observed_workflow_jobs ): fail(f"required-checks matrix metadata is not bound to {repository}", errors) @@ -657,7 +706,14 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: fail(f"wiki/11_ORG_SYSTEM_MAP.md missing Hoxline routing: {route}", errors) if "plat --> hox" in system_map_text: fail("wiki/11_ORG_SYSTEM_MAP.md must not route platform backward through Hoxline", errors) - if re.search(r"\bhox(?:line)? --> proof\b", system_map_text): + mermaid_link = ( + r"(?:-->|---|-\.->|-\.-|==>|===|~~~|" + r"--\s+[^>\n]+?\s+-->|-\.\s+[^.\n]+?\s+\.->|==\s+[^>\n]+?\s+==>)" + ) + if re.search( + rf"\bhox(?:line)?\b\s*{mermaid_link}\s*(?:\|[^|\n]*\|\s*)?\bproof\b", + system_map_text, + ): fail("wiki/11_ORG_SYSTEM_MAP.md must not bypass platform between Hoxline and proof", errors) if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) From 6e6179a8355637585570bc15c04441031cf6ec08 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:37:53 -0500 Subject: [PATCH 026/101] Parse decorated Mermaid bypass edges --- scripts/verify-command-center-invariants.py | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index a7d084d..2587d06 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -706,14 +706,18 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: fail(f"wiki/11_ORG_SYSTEM_MAP.md missing Hoxline routing: {route}", errors) if "plat --> hox" in system_map_text: fail("wiki/11_ORG_SYSTEM_MAP.md must not route platform backward through Hoxline", errors) + mermaid_node_decoration = ( + r"(?:\s*(?:\[[^\n]*?\]|\([^\n]*?\)|\{[^\n]*?\}|@\{[^\n]*?\}|:::[A-Za-z0-9_-]+))*" + ) mermaid_link = ( - r"(?:-->|---|-\.->|-\.-|==>|===|~~~|" - r"--\s+[^>\n]+?\s+-->|-\.\s+[^.\n]+?\s+\.->|==\s+[^>\n]+?\s+==>)" + r"(?:[-.=~]{2,}\s+[^|>\n]+?\s+[-.=~]{2,}>?|[-.=~]{2,}>?)" + r"(?:\|[^|\n]*\|)?" ) - if re.search( - rf"\bhox(?:line)?\b\s*{mermaid_link}\s*(?:\|[^|\n]*\|\s*)?\bproof\b", - system_map_text, - ): + direct_hoxline_proof_edge = re.compile( + rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*proof\b", + re.MULTILINE, + ) + if direct_hoxline_proof_edge.search(system_map_text): fail("wiki/11_ORG_SYSTEM_MAP.md must not bypass platform between Hoxline and proof", errors) if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) From 8d95b1d38f3d97bfcd64a5d36a899c239e0730ff Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:40:29 -0500 Subject: [PATCH 027/101] Parse Mermaid endpoint edge forms --- scripts/verify-command-center-invariants.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 2587d06..4e9d8c1 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -709,8 +709,9 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: mermaid_node_decoration = ( r"(?:\s*(?:\[[^\n]*?\]|\([^\n]*?\)|\{[^\n]*?\}|@\{[^\n]*?\}|:::[A-Za-z0-9_-]+))*" ) + mermaid_edge_segment = r"[ox<]?[-.=~]{2,}[>ox]?" mermaid_link = ( - r"(?:[-.=~]{2,}\s+[^|>\n]+?\s+[-.=~]{2,}>?|[-.=~]{2,}>?)" + rf"(?:{mermaid_edge_segment}\s+[^|>\n]+?\s+{mermaid_edge_segment}|{mermaid_edge_segment})" r"(?:\|[^|\n]*\|)?" ) direct_hoxline_proof_edge = re.compile( From b8d52d787e11886276d1b60bf5f52878576b75c4 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:48:12 -0500 Subject: [PATCH 028/101] Bind canonical checks and Mermaid fan-out --- scripts/verify-command-center-invariants.py | 57 +++++++++++++++------ 1 file changed, 40 insertions(+), 17 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 4e9d8c1..12c2e7d 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -567,14 +567,12 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ".github": ( "Organization control-plane routing and reviewer entry point.", (".github/workflows/command-center-invariants.yml",), - "command-center-invariants", - "command-center-invariants", + (("command-center-invariants", "command-center-invariants"),), ), "hoxline": ( "Product / ProofOps control experience and Claim Authority capabilities.", (".github/workflows/ci.yml",), - "ci", - "test", + (("ci", "test"),), ), "hawkinsoperations-detections": ( "Detection source truth.", @@ -582,8 +580,10 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ".github/workflows/baseline-detection-contract.yml", ".github/workflows/governance-gate.yml", ), - "baseline-detection-contract", - "baseline-hero-artifact-contract", + ( + ("baseline-detection-contract", "baseline-hero-artifact-contract"), + ("Governance Gate", "required-files"), + ), ), "hawkinsoperations-validation": ( "Validation behavior, fixtures, reports, and claim-boundary scan truth.", @@ -599,8 +599,18 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ".github/workflows/security-onion-visibility-contract.yml", ".github/workflows/cross-repo-claim-parity.yml", ), - "baseline-validation-contract", - "baseline-hero-validation-contract", + ( + ("baseline-validation-contract", "baseline-hero-validation-contract"), + ("Governance Gate", "required-files"), + ("HO-DET-012 Fixture Loop", "ho-det-012-fixture-loop"), + ("ID-DET-001 Fixture Loop", "id-det-001-fixture-loop"), + ("HO-DET-001 Proof Loop", "ho-det-001-proof-loop"), + ("Public HO-DET-001 Controlled-Test Report", "public-ho-det-001-controlled-test-report"), + ("AWS-DET-001 Fixture Loop", "aws-det-001-fixture-loop"), + ("HO-DET-011 Fixture Loop", "ho-det-011-fixture-loop"), + ("security-onion-visibility-contract", "security-onion-visibility-contract"), + ("Cross Repo Claim Parity", "cross-repo-claim-parity"), + ), ), "hawkinsoperations-platform": ( "Platform runtime/agent boundary contracts and status/plan visibility.", @@ -608,8 +618,11 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ".github/workflows/governance-gate.yml", ".github/workflows/local-gpu-triage-gate.yml", ), - "Local GPU Triage Gate", - "local-gpu-triage-status", + ( + ("Governance Gate", "required-files"), + ("Governance Gate", "ho-det-011-case-packet"), + ("Local GPU Triage Gate", "local-gpu-triage-status"), + ), ), "hawkinsoperations-proof": ( "Proof records, proof indexes, claim ceilings, and public-proof linkage.", @@ -619,17 +632,23 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ".github/workflows/ho-det-001-proof-integrity.yml", ".github/workflows/publish-proof-release.yml", ), - "baseline-proof-integrity", - "baseline-hod001-proof-integrity", + ( + ("baseline-proof-integrity", "baseline-hod001-proof-integrity"), + ("Governance Gate", "required-files"), + ("ho-det-001-proof-integrity", "ho-det-001-proof-integrity"), + ("Proof Pack 001 Release Check", "proof-pack-001-release-check"), + ), ), "hawkinsoperations-website": ( "Public rendering of approved public state.", (".github/workflows/governance-gate.yml",), - "Governance Gate", - "build", + ( + ("Governance Gate", "required-files"), + ("Governance Gate", "build"), + ), ), } - for repository, (truth_surface, expected_workflow_files, workflow_name, job_id) in expected_required_check_markers.items(): + for repository, (truth_surface, expected_workflow_files, expected_workflow_jobs) in expected_required_check_markers.items(): block = required_checks_blocks.get(repository, {}) workflow_files = block.get("workflow_file", []) if isinstance(block, dict) else [] job_contexts = block.get("job_check_context", []) if isinstance(block, dict) else [] @@ -644,7 +663,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: block.get("truth_surface") != truth_surface or not isinstance(workflow_files, list) or tuple(workflow_files) != expected_workflow_files - or (workflow_name, job_id) not in observed_workflow_jobs + or observed_workflow_jobs != set(expected_workflow_jobs) ): fail(f"required-checks matrix metadata is not bound to {repository}", errors) declared_pairs: list[tuple[str, str]] = [] @@ -718,7 +737,11 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*proof\b", re.MULTILINE, ) - if direct_hoxline_proof_edge.search(system_map_text): + compound_hoxline_proof_edge = re.compile( + rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*[^\n]*&\s*(?:proof|website)\b", + re.MULTILINE, + ) + if direct_hoxline_proof_edge.search(system_map_text) or compound_hoxline_proof_edge.search(system_map_text): fail("wiki/11_ORG_SYSTEM_MAP.md must not bypass platform between Hoxline and proof", errors) if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) From b5fffdb01f6dbabf041b96d458344bafa986ace6 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 18:53:40 -0500 Subject: [PATCH 029/101] Reject direct Hoxline website bypasses --- scripts/verify-command-center-invariants.py | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 12c2e7d..c18757c 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -734,15 +734,15 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: r"(?:\|[^|\n]*\|)?" ) direct_hoxline_proof_edge = re.compile( - rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*proof\b", + rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*(?:proof|web(?:site)?)\b", re.MULTILINE, ) compound_hoxline_proof_edge = re.compile( - rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*[^\n]*&\s*(?:proof|website)\b", + rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*[^\n]*&\s*(?:proof|web(?:site)?)\b", re.MULTILINE, ) if direct_hoxline_proof_edge.search(system_map_text) or compound_hoxline_proof_edge.search(system_map_text): - fail("wiki/11_ORG_SYSTEM_MAP.md must not bypass platform between Hoxline and proof", errors) + fail("wiki/11_ORG_SYSTEM_MAP.md must not bypass platform and proof between Hoxline and public output", errors) if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) From a6c46cba024c4973fe8401aa03c852d6a930fa63 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:00:31 -0500 Subject: [PATCH 030/101] Preserve required check classifications --- scripts/verify-command-center-invariants.py | 30 ++++++++++++++++----- 1 file changed, 24 insertions(+), 6 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index c18757c..c39a5bd 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -567,11 +567,13 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ".github": ( "Organization control-plane routing and reviewer entry point.", (".github/workflows/command-center-invariants.yml",), + (), (("command-center-invariants", "command-center-invariants"),), ), "hoxline": ( "Product / ProofOps control experience and Claim Authority capabilities.", (".github/workflows/ci.yml",), + (), (("ci", "test"),), ), "hawkinsoperations-detections": ( @@ -584,6 +586,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ("baseline-detection-contract", "baseline-hero-artifact-contract"), ("Governance Gate", "required-files"), ), + (), ), "hawkinsoperations-validation": ( "Validation behavior, fixtures, reports, and claim-boundary scan truth.", @@ -609,8 +612,8 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ("AWS-DET-001 Fixture Loop", "aws-det-001-fixture-loop"), ("HO-DET-011 Fixture Loop", "ho-det-011-fixture-loop"), ("security-onion-visibility-contract", "security-onion-visibility-contract"), - ("Cross Repo Claim Parity", "cross-repo-claim-parity"), ), + (("Cross Repo Claim Parity", "cross-repo-claim-parity"),), ), "hawkinsoperations-platform": ( "Platform runtime/agent boundary contracts and status/plan visibility.", @@ -621,8 +624,8 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ( ("Governance Gate", "required-files"), ("Governance Gate", "ho-det-011-case-packet"), - ("Local GPU Triage Gate", "local-gpu-triage-status"), ), + (("Local GPU Triage Gate", "local-gpu-triage-status"),), ), "hawkinsoperations-proof": ( "Proof records, proof indexes, claim ceilings, and public-proof linkage.", @@ -638,6 +641,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ("ho-det-001-proof-integrity", "ho-det-001-proof-integrity"), ("Proof Pack 001 Release Check", "proof-pack-001-release-check"), ), + (), ), "hawkinsoperations-website": ( "Public rendering of approved public state.", @@ -646,9 +650,15 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ("Governance Gate", "required-files"), ("Governance Gate", "build"), ), + (), ), } - for repository, (truth_surface, expected_workflow_files, expected_workflow_jobs) in expected_required_check_markers.items(): + for repository, ( + truth_surface, + expected_workflow_files, + expected_required_jobs, + expected_non_required_jobs, + ) in expected_required_check_markers.items(): block = required_checks_blocks.get(repository, {}) workflow_files = block.get("workflow_file", []) if isinstance(block, dict) else [] job_contexts = block.get("job_check_context", []) if isinstance(block, dict) else [] @@ -663,21 +673,29 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: block.get("truth_surface") != truth_surface or not isinstance(workflow_files, list) or tuple(workflow_files) != expected_workflow_files - or observed_workflow_jobs != set(expected_workflow_jobs) + or observed_workflow_jobs != set((*expected_required_jobs, *expected_non_required_jobs)) ): fail(f"required-checks matrix metadata is not bound to {repository}", errors) declared_pairs: list[tuple[str, str]] = [] - for declaration_field in ("required_checks_observed", "important_non_required_checks"): + for declaration_field, expected_pairs in ( + ("required_checks_observed", expected_required_jobs), + ("important_non_required_checks", expected_non_required_jobs), + ): declarations = block.get(declaration_field, []) if isinstance(block, dict) else [] if not isinstance(declarations, list) or any(not isinstance(item, str) for item in declarations): fail(f"{repository} {declaration_field} must be a list of workflow / job strings", errors) continue + field_pairs: list[tuple[str, str]] = [] for declaration in declarations: match = re.match(r"^(.+?) / ([A-Za-z0-9_.-]+)(?:\s|$)", declaration) if not match: fail(f"{repository} {declaration_field} has an unparseable workflow / job declaration", errors) continue - declared_pairs.append((match.group(1), match.group(2))) + pair = (match.group(1), match.group(2)) + field_pairs.append(pair) + declared_pairs.append(pair) + if set(field_pairs) != set(expected_pairs): + fail(f"{repository} {declaration_field} does not match its canonical check classification", errors) if len(declared_pairs) != len(set(declared_pairs)): fail(f"{repository} check declarations contain duplicate workflow / job pairs", errors) actual_pairs = [ From f79f3a140ecb716f8f62e1e6d00595a1efed5a06 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:06:37 -0500 Subject: [PATCH 031/101] Fingerprint the complete required checks contract --- scripts/verify-command-center-invariants.py | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index c39a5bd..cd21723 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -28,6 +28,10 @@ # gate, blocked claim, status, or current-state change requires an intentional # verifier update. EXPECTED_PROMOTION_CONTRACT_SHA256 = "65522c07b7e2983379dcb3ea1ba5b4cd03ccb3e5116983931bb8c3e23b36c7c8" +# Fingerprint of the complete reviewed required-checks matrix. This binds each +# workflow/job context to its verifier command, display metadata, enforcement +# classification, and documented boundary; changes require intentional review. +EXPECTED_REQUIRED_CHECKS_MATRIX_SHA256 = "2cefa14bcd21ec9dfa1a491c791116d7806fe67c18c0f8bce5f669e7b2eb4f44" EXPECTED_INVARIANTS = { "github_repo_role": ".github is reviewer routing and governance shell only", "presentation_route": "hawkinsoperations.com is the Website Reviewer Guide and presentation surface", @@ -543,6 +547,15 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: fail("Hoxline promotion layer must preserve its exact position, boundaries, gates, statuses, and human-review requirement", errors) required_checks_document = read_yaml_mapping(ROOT / "governance" / "ORG_REQUIRED_CHECKS_MATRIX.yml", errors) + required_checks_payload = json.dumps( + required_checks_document, + sort_keys=True, + separators=(",", ":"), + ensure_ascii=False, + ).encode("utf-8") + required_checks_fingerprint = hashlib.sha256(required_checks_payload).hexdigest() + if required_checks_fingerprint != EXPECTED_REQUIRED_CHECKS_MATRIX_SHA256: + fail("complete required-checks matrix does not match the reviewed machine-readable mapping", errors) if required_checks_document.get("status") != "PHASE_2B_ORG_INVARIANT_AND_VALIDATION_ENFORCEMENT_RECORDED": fail("required-checks matrix must preserve the current Phase 2B status", errors) expected_phase_2b_boundary = { From 576d7b140cae120016c69e5ed38d7e949510d8ff Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:14:14 -0500 Subject: [PATCH 032/101] Pin invariant routes and normalize Mermaid edges --- scripts/verify-command-center-invariants.py | 51 +++++++++++++++++---- 1 file changed, 42 insertions(+), 9 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index cd21723..a4b702b 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -32,6 +32,9 @@ # workflow/job context to its verifier command, display metadata, enforcement # classification, and documented boundary; changes require intentional review. EXPECTED_REQUIRED_CHECKS_MATRIX_SHA256 = "2cefa14bcd21ec9dfa1a491c791116d7806fe67c18c0f8bce5f669e7b2eb4f44" +# Fingerprint of the complete reviewed invariant manifest, including the exact +# required route list and seven-repository authority order. +EXPECTED_MANIFEST_SHA256 = "9bf2fc9dd8d8d64a25422e8784019a0827d89ac00348c73289df5d83153df122" EXPECTED_INVARIANTS = { "github_repo_role": ".github is reviewer routing and governance shell only", "presentation_route": "hawkinsoperations.com is the Website Reviewer Guide and presentation surface", @@ -297,6 +300,14 @@ def load_manifest(errors: list[str]) -> dict: except json.JSONDecodeError as exc: fail(f"manifest JSON parse failed: {exc}", errors) return {} + manifest_payload = json.dumps( + manifest, + sort_keys=True, + separators=(",", ":"), + ensure_ascii=False, + ).encode("utf-8") + if hashlib.sha256(manifest_payload).hexdigest() != EXPECTED_MANIFEST_SHA256: + fail("complete invariant manifest does not match the reviewed machine-readable mapping", errors) if manifest.get("schema") != "hawkinsoperations-command-center-invariants-v1": fail("manifest schema mismatch", errors) if manifest.get("invariants") != EXPECTED_INVARIANTS: @@ -760,20 +771,42 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: r"(?:\s*(?:\[[^\n]*?\]|\([^\n]*?\)|\{[^\n]*?\}|@\{[^\n]*?\}|:::[A-Za-z0-9_-]+))*" ) mermaid_edge_segment = r"[ox<]?[-.=~]{2,}[>ox]?" + mermaid_label_start = r"[-.=~]{2,}" + mermaid_label_end = r"[-.=~]{2,}[>ox]?" mermaid_link = ( - rf"(?:{mermaid_edge_segment}\s+[^|>\n]+?\s+{mermaid_edge_segment}|{mermaid_edge_segment})" + rf"(?:{mermaid_label_start}\s+[^|>\n]+?\s+{mermaid_label_end}|{mermaid_edge_segment})" r"(?:\|[^|\n]*\|)?" ) - direct_hoxline_proof_edge = re.compile( - rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*(?:proof|web(?:site)?)\b", - re.MULTILINE, + mermaid_node_ref = rf"[A-Za-z_][A-Za-z0-9_-]*{mermaid_node_decoration}" + mermaid_node_group = rf"{mermaid_node_ref}(?:\s*&\s*{mermaid_node_ref})*" + mermaid_edge_statement = re.compile( + rf"(?=(?P{mermaid_node_group})\s*{mermaid_link}\s*(?P{mermaid_node_group}))" ) - compound_hoxline_proof_edge = re.compile( - rf"^\s*hox(?:line)?\b{mermaid_node_decoration}\s*{mermaid_link}\s*[^\n]*&\s*(?:proof|web(?:site)?)\b", - re.MULTILINE, + mermaid_node_identifier = re.compile( + rf"(?:^|&)\s*([A-Za-z_][A-Za-z0-9_-]*){mermaid_node_decoration}" ) - if direct_hoxline_proof_edge.search(system_map_text) or compound_hoxline_proof_edge.search(system_map_text): - fail("wiki/11_ORG_SYSTEM_MAP.md must not bypass platform and proof between Hoxline and public output", errors) + forbidden_hoxline_peers = {"proof", "web", "website"} + for line in system_map_text.splitlines(): + for edge in mermaid_edge_statement.finditer(line): + left_ids = { + match.group(1).lower() + for match in mermaid_node_identifier.finditer(edge.group("left")) + } + right_ids = { + match.group(1).lower() + for match in mermaid_node_identifier.finditer(edge.group("right")) + } + left_has_hoxline = bool(left_ids & {"hox", "hoxline"}) + right_has_hoxline = bool(right_ids & {"hox", "hoxline"}) + if ( + (left_has_hoxline and right_ids & forbidden_hoxline_peers) + or (right_has_hoxline and left_ids & forbidden_hoxline_peers) + ): + fail( + "wiki/11_ORG_SYSTEM_MAP.md must not bypass platform and proof between Hoxline and public output", + errors, + ) + break if re.search(r"^\| (?:Total ledger events|Total cases|Public-safe count|Closed-case count) \|", system_map_text, re.MULTILINE): fail("wiki/11_ORG_SYSTEM_MAP.md must route changing ledger values instead of copying counts", errors) From f0a4fd17c5f844797439e45980ad93c0e05431bd Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:18:46 -0500 Subject: [PATCH 033/101] Parse Mermaid edge identifiers --- scripts/verify-command-center-invariants.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index a4b702b..fe67a04 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -779,8 +779,9 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ) mermaid_node_ref = rf"[A-Za-z_][A-Za-z0-9_-]*{mermaid_node_decoration}" mermaid_node_group = rf"{mermaid_node_ref}(?:\s*&\s*{mermaid_node_ref})*" + mermaid_edge_id = r"(?:\s+[A-Za-z_][A-Za-z0-9_-]*@)?" mermaid_edge_statement = re.compile( - rf"(?=(?P{mermaid_node_group})\s*{mermaid_link}\s*(?P{mermaid_node_group}))" + rf"(?=(?P{mermaid_node_group}){mermaid_edge_id}\s*{mermaid_link}\s*(?P{mermaid_node_group}))" ) mermaid_node_identifier = re.compile( rf"(?:^|&)\s*([A-Za-z_][A-Za-z0-9_-]*){mermaid_node_decoration}" From 3f57558119d33be0e4c54fcb528cef91c6f7943c Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:24:25 -0500 Subject: [PATCH 034/101] Parse quoted Mermaid edge labels --- scripts/verify-command-center-invariants.py | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index fe67a04..f600b21 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -773,9 +773,12 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: mermaid_edge_segment = r"[ox<]?[-.=~]{2,}[>ox]?" mermaid_label_start = r"[-.=~]{2,}" mermaid_label_end = r"[-.=~]{2,}[>ox]?" + mermaid_quoted_label = r'"(?:\\.|[^"\\])*"' + mermaid_inline_label = rf"(?:{mermaid_quoted_label}|[^|>\n]+?)" + mermaid_pipe_label = rf"(?:{mermaid_quoted_label}|[^|\n]*)" mermaid_link = ( - rf"(?:{mermaid_label_start}\s+[^|>\n]+?\s+{mermaid_label_end}|{mermaid_edge_segment})" - r"(?:\|[^|\n]*\|)?" + rf"(?:{mermaid_label_start}\s+{mermaid_inline_label}\s+{mermaid_label_end}|{mermaid_edge_segment})" + rf"(?:\|{mermaid_pipe_label}\|)?" ) mermaid_node_ref = rf"[A-Za-z_][A-Za-z0-9_-]*{mermaid_node_decoration}" mermaid_node_group = rf"{mermaid_node_ref}(?:\s*&\s*{mermaid_node_ref})*" From 195ece7778fd121579d9f5d482e82c3e427e874a Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:30:02 -0500 Subject: [PATCH 035/101] Pin topology and reject duplicate JSON keys --- scripts/verify-command-center-invariants.py | 23 +++++++++++++++++++-- 1 file changed, 21 insertions(+), 2 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index f600b21..39b1fb2 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -35,6 +35,9 @@ # Fingerprint of the complete reviewed invariant manifest, including the exact # required route list and seven-repository authority order. EXPECTED_MANIFEST_SHA256 = "9bf2fc9dd8d8d64a25422e8784019a0827d89ac00348c73289df5d83153df122" +# Fingerprint of every reviewed Mermaid block in the organization system map. +# Any topology, alias, or edge change requires an intentional verifier update. +EXPECTED_SYSTEM_MAP_MERMAID_SHA256 = "5e0e2ce49506de2a02d3bb981be1823ae33194908c5d234e286c92f0a201edd8" EXPECTED_INVARIANTS = { "github_repo_role": ".github is reviewer routing and governance shell only", "presentation_route": "hawkinsoperations.com is the Website Reviewer Guide and presentation surface", @@ -239,6 +242,15 @@ def fail(message: str, errors: list[str]) -> None: errors.append(message) +def construct_unique_json_object(pairs: list[tuple[str, object]]) -> dict: + result: dict = {} + for key, value in pairs: + if key in result: + raise ValueError(f"duplicate JSON key: {key!r}") + result[key] = value + return result + + def read_text(path: Path, errors: list[str]) -> str: if not path.exists(): fail(f"missing file: {path.relative_to(ROOT).as_posix()}", errors) @@ -296,8 +308,8 @@ def load_manifest(errors: list[str]) -> dict: if not text: return {} try: - manifest = json.loads(text) - except json.JSONDecodeError as exc: + manifest = json.loads(text, object_pairs_hook=construct_unique_json_object) + except ValueError as exc: fail(f"manifest JSON parse failed: {exc}", errors) return {} manifest_payload = json.dumps( @@ -754,6 +766,13 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: fail("pull request template must enumerate exactly seven downstream repositories plus None", errors) system_map_text = read_text(ROOT / "wiki" / "11_ORG_SYSTEM_MAP.md", errors) + mermaid_blocks = re.findall(r"```mermaid\s*(.*?)```", system_map_text, re.DOTALL) + normalized_mermaid = "\n\n--- mermaid block ---\n\n".join( + "\n".join(line.rstrip() for line in block.strip().splitlines()) + for block in mermaid_blocks + ).encode("utf-8") + if hashlib.sha256(normalized_mermaid).hexdigest() != EXPECTED_SYSTEM_MAP_MERMAID_SHA256: + fail("organization system-map Mermaid topology does not match the complete reviewed graph", errors) required_hoxline_routes = ( 'hox["hoxline
product / ProofOps control', "org --> hox", From bb936fc7f5d740a768652b2edcddbc363b18de3a Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:32:38 -0500 Subject: [PATCH 036/101] Normalize Mermaid fence variants --- scripts/verify-command-center-invariants.py | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 39b1fb2..6671fac 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -766,7 +766,12 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: fail("pull request template must enumerate exactly seven downstream repositories plus None", errors) system_map_text = read_text(ROOT / "wiki" / "11_ORG_SYSTEM_MAP.md", errors) - mermaid_blocks = re.findall(r"```mermaid\s*(.*?)```", system_map_text, re.DOTALL) + mermaid_fence = re.compile( + r"^[ \t]{0,3}(?P`|~)(?P=marker){2,}[ \t]*mermaid[^\r\n]*\r?\n" + r"(?P.*?)(?=^[ \t]{0,3}(?P=marker){3,}[ \t]*$)", + re.DOTALL | re.IGNORECASE | re.MULTILINE, + ) + mermaid_blocks = [match.group("body") for match in mermaid_fence.finditer(system_map_text)] normalized_mermaid = "\n\n--- mermaid block ---\n\n".join( "\n".join(line.rstrip() for line in block.strip().splitlines()) for block in mermaid_blocks From 70ee591e321678a414dbafc2e3aa2b9afa18c20f Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:34:45 -0500 Subject: [PATCH 037/101] Fingerprint unclosed Mermaid fences --- scripts/verify-command-center-invariants.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 6671fac..4556631 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -768,7 +768,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: system_map_text = read_text(ROOT / "wiki" / "11_ORG_SYSTEM_MAP.md", errors) mermaid_fence = re.compile( r"^[ \t]{0,3}(?P`|~)(?P=marker){2,}[ \t]*mermaid[^\r\n]*\r?\n" - r"(?P.*?)(?=^[ \t]{0,3}(?P=marker){3,}[ \t]*$)", + r"(?P.*?)(?=^[ \t]{0,3}(?P=marker){3,}[ \t]*$|\Z)", re.DOTALL | re.IGNORECASE | re.MULTILINE, ) mermaid_blocks = [match.group("body") for match in mermaid_fence.finditer(system_map_text)] From ad120de662ae38978406907020b2d24657dc6207 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:43:12 -0500 Subject: [PATCH 038/101] Bind visible authority and order semantics --- governance/COMMAND_CENTER_INVARIANTS.json | 1 + scripts/verify-command-center-invariants.py | 28 +++++++++++++++------ 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/governance/COMMAND_CENTER_INVARIANTS.json b/governance/COMMAND_CENTER_INVARIANTS.json index 847ce25..4383084 100644 --- a/governance/COMMAND_CENTER_INVARIANTS.json +++ b/governance/COMMAND_CENTER_INVARIANTS.json @@ -1,6 +1,7 @@ { "schema": "hawkinsoperations-command-center-invariants-v1", "scope": "HawkinsOperations/.github reviewer routing and governance shell", + "system_repository_order_semantics": "Stable front-door inventory display order; promotion flow is separately governed by PROMOTION_LADDER_CONTRACT.yml.", "system_repositories": [ ".github", "hoxline", diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 4556631..20107d6 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -15,6 +15,8 @@ ROOT = Path(__file__).resolve().parents[1] MANIFEST_PATH = ROOT / "governance" / "COMMAND_CENTER_INVARIANTS.json" TEXT_SCOPES = ["README.md", "profile", "architecture", "governance", "wiki", ".github"] +# Stable public inventory order. This is not the promotion-ladder sequence, +# which is separately governed and verified from PROMOTION_LADDER_CONTRACT.yml. SYSTEM_REPOSITORIES = ( ".github", "hoxline", @@ -34,7 +36,7 @@ EXPECTED_REQUIRED_CHECKS_MATRIX_SHA256 = "2cefa14bcd21ec9dfa1a491c791116d7806fe67c18c0f8bce5f669e7b2eb4f44" # Fingerprint of the complete reviewed invariant manifest, including the exact # required route list and seven-repository authority order. -EXPECTED_MANIFEST_SHA256 = "9bf2fc9dd8d8d64a25422e8784019a0827d89ac00348c73289df5d83153df122" +EXPECTED_MANIFEST_SHA256 = "943483cc693072d519d5b397b89479f0efa4f0c027273f3a53f557d59af20cd3" # Fingerprint of every reviewed Mermaid block in the organization system map. # Any topology, alias, or edge change requires an intentional verifier update. EXPECTED_SYSTEM_MAP_MERMAID_SHA256 = "5e0e2ce49506de2a02d3bb981be1823ae33194908c5d234e286c92f0a201edd8" @@ -242,6 +244,11 @@ def fail(message: str, errors: list[str]) -> None: errors.append(message) +def strip_html_comments(text: str) -> str: + """Return reviewer-visible Markdown by removing non-rendered HTML comments.""" + return re.sub(r"", "", text, flags=re.DOTALL) + + def construct_unique_json_object(pairs: list[tuple[str, object]]) -> dict: result: dict = {} for key, value in pairs: @@ -322,6 +329,11 @@ def load_manifest(errors: list[str]) -> dict: fail("complete invariant manifest does not match the reviewed machine-readable mapping", errors) if manifest.get("schema") != "hawkinsoperations-command-center-invariants-v1": fail("manifest schema mismatch", errors) + if manifest.get("system_repository_order_semantics") != ( + "Stable front-door inventory display order; promotion flow is separately governed " + "by PROMOTION_LADDER_CONTRACT.yml." + ): + fail("manifest must distinguish inventory display order from promotion-ladder sequence", errors) if manifest.get("invariants") != EXPECTED_INVARIANTS: fail("manifest invariants must match the exact reviewed authority contract", errors) return manifest @@ -343,7 +355,7 @@ def check_required_files(manifest: dict, errors: list[str]) -> None: def check_required_text(errors: list[str]) -> None: for rel, needles in REQUIRED_TEXT.items(): - text = read_text(ROOT / rel, errors) + text = strip_html_comments(read_text(ROOT / rel, errors)) lowered = text.lower() for needle in needles: if needle.lower() not in lowered: @@ -353,15 +365,15 @@ def check_required_text(errors: list[str]) -> None: def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: manifest_repositories = tuple(manifest.get("system_repositories", [])) if manifest_repositories != SYSTEM_REPOSITORIES: - fail("manifest system_repositories must list the exact seven repositories in authority order", errors) + fail("manifest system_repositories must preserve the exact seven-repository inventory display order", errors) for rel in ("README.md", "profile/README.md", "profile/START_HERE.md", "architecture/REPO_AUTHORITY_MAP.md"): - text = read_text(ROOT / rel, errors).lower() + text = strip_html_comments(read_text(ROOT / rel, errors)).lower() for repository in SYSTEM_REPOSITORIES: if repository.lower() not in text: fail(f"{rel} missing system repository role: {repository}", errors) - profile_text = read_text(ROOT / "profile" / "README.md", errors) + profile_text = strip_html_comments(read_text(ROOT / "profile" / "README.md", errors)) profile = profile_text.lower() door_section = re.search( r"## Choose the right door\s+(.*?)(?=\n## |\Z)", @@ -394,7 +406,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: profile_text, re.MULTILINE, ) - start_here_text = read_text(ROOT / "profile" / "START_HERE.md", errors) + start_here_text = strip_html_comments(read_text(ROOT / "profile" / "START_HERE.md", errors)) start_here_fast_path = re.search( r"## 3-minute command-center path\s+(.*?)(?=\n## |\Z)", start_here_text, @@ -498,7 +510,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: ), ) for rel, heading, expected_header, expected_rows in authority_tables: - table_text = read_text(ROOT / rel, errors) + table_text = strip_html_comments(read_text(ROOT / rel, errors)) section_match = re.search( rf"## {re.escape(heading)}\s+(.*?)(?=\n## |\Z)", table_text, @@ -765,7 +777,7 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if actual_downstream_repos != expected_downstream_repos: fail("pull request template must enumerate exactly seven downstream repositories plus None", errors) - system_map_text = read_text(ROOT / "wiki" / "11_ORG_SYSTEM_MAP.md", errors) + system_map_text = strip_html_comments(read_text(ROOT / "wiki" / "11_ORG_SYSTEM_MAP.md", errors)) mermaid_fence = re.compile( r"^[ \t]{0,3}(?P`|~)(?P=marker){2,}[ \t]*mermaid[^\r\n]*\r?\n" r"(?P.*?)(?=^[ \t]{0,3}(?P=marker){3,}[ \t]*$|\Z)", From de61ef24c1663f020fd559cee07dfa60bc9e3463 Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:45:42 -0500 Subject: [PATCH 039/101] Parse reviewer-visible Markdown consistently --- scripts/verify-command-center-invariants.py | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 20107d6..61aad7d 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -246,7 +246,7 @@ def fail(message: str, errors: list[str]) -> None: def strip_html_comments(text: str) -> str: """Return reviewer-visible Markdown by removing non-rendered HTML comments.""" - return re.sub(r"", "", text, flags=re.DOTALL) + return re.sub(r"|\Z)", "", text, flags=re.DOTALL) def construct_unique_json_object(pairs: list[tuple[str, object]]) -> dict: @@ -755,7 +755,9 @@ def check_front_door_authority_model(manifest: dict, errors: list[str]) -> None: if set(actual_pairs) != set(declared_pairs): fail(f"{repository} declared checks and structured workflow / job contexts must match exactly", errors) - template_text = read_text(ROOT / ".github" / "pull_request_template.md", errors) + template_text = strip_html_comments( + read_text(ROOT / ".github" / "pull_request_template.md", errors) + ) downstream_section = re.search( r"- Downstream repos affected:\s+(.*?)(?=\n- Downstream action:)", template_text, From 103eb00129532bad5a435024d44feec13d420fdf Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:47:28 -0500 Subject: [PATCH 040/101] Filter hidden aggregate governance text --- scripts/verify-command-center-invariants.py | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index 61aad7d..c3462a0 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -963,7 +963,10 @@ def main() -> int: check_front_door_authority_model(manifest, errors) text_files = iter_text_files() - all_text = "\n".join(path.read_text(encoding="utf-8", errors="ignore") for path in text_files) + all_text = "\n".join( + strip_html_comments(path.read_text(encoding="utf-8", errors="ignore")) + for path in text_files + ) check_project_boundaries(all_text, errors) check_ceiling_boundaries(all_text, errors) check_standing_controls(all_text, errors) From 3395ba6d24a60e49d22e6f495abf01c0e1b3d5dc Mon Sep 17 00:00:00 2001 From: Raylee Hawkins Date: Mon, 10 Aug 2026 19:50:40 -0500 Subject: [PATCH 041/101] Preserve visible Markdown code in boundary scans --- scripts/verify-command-center-invariants.py | 94 ++++++++++++++++++--- 1 file changed, 83 insertions(+), 11 deletions(-) diff --git a/scripts/verify-command-center-invariants.py b/scripts/verify-command-center-invariants.py index c3462a0..bbb7907 100644 --- a/scripts/verify-command-center-invariants.py +++ b/scripts/verify-command-center-invariants.py @@ -245,8 +245,74 @@ def fail(message: str, errors: list[str]) -> None: def strip_html_comments(text: str) -> str: - """Return reviewer-visible Markdown by removing non-rendered HTML comments.""" - return re.sub(r"|\Z)", "", text, flags=re.DOTALL) + """Remove Markdown HTML comments while preserving reviewer-visible code.""" + output: list[str] = [] + in_comment = False + inline_ticks = 0 + fence_marker = "" + fence_length = 0 + + for line in text.splitlines(keepends=True): + if fence_marker: + output.append(line) + closing = re.match(rf"^[ \t]{{0,3}}{re.escape(fence_marker)}{{{fence_length},}}[ \t]*(?:\r?\n)?$", line) + if closing: + fence_marker = "" + fence_length = 0 + continue + + if not in_comment and inline_ticks == 0: + opening = re.match(r"^[ \t]{0,3}(`{3,}|~{3,})", line) + if opening: + marker_run = opening.group(1) + fence_marker = marker_run[0] + fence_length = len(marker_run) + output.append(line) + continue + if re.match(r"^(?: {4}|\t)", line): + output.append(line) + continue + + index = 0 + while index < len(line): + if in_comment: + closing_index = line.find("-->", index) + if closing_index < 0: + index = len(line) + continue + in_comment = False + index = closing_index + 3 + continue + + if inline_ticks: + tick_match = re.search(r"`+", line[index:]) + if not tick_match: + output.append(line[index:]) + index = len(line) + continue + tick_start = index + tick_match.start() + tick_run = tick_match.group(0) + output.append(line[index:tick_start + len(tick_run)]) + index = tick_start + len(tick_run) + if len(tick_run) == inline_ticks: + inline_ticks = 0 + continue + + if line.startswith("