Skip to content

Governance

Operational governance for the workspace: policies, security baseline, audit specs, runbooks, and the docs/publish pipeline.

Files

File Purpose
repo-contract.schema.json Machine-validated contract for each namespace repo.
permissions-matrix.yaml Orchestration agent allow/deny matrix.
release-policy.md Stage 0/½ promotion gates.
runtime-policy.yaml Runtime + data-class constraints.
security-privacy-baseline.v1.md SPB-01..SPB-15 control catalog.
credential-lifecycle-policy.yaml Provisioning, rotation, JIT, revocation.

Companion runbooks: runbooks/. Audit spec: audit/audit-log-spec.md.

Ownership

Artifact Owner
repo-contract.schema.json platform
permissions-matrix.yaml security
runtime-policy.yaml security
credential-lifecycle-policy.yaml security
release-policy.md platform + security (co-owned)
security-privacy-baseline.v1.md security + compliance (co-owned)
audit-log-spec.md security + compliance
runbooks/onboard-project.md operations
runbooks/compatibility-validation.md operations
runbooks/orchestration-recovery.md operations
runbooks/agent-credential-provisioning.md operations + security
runbooks/credential-rotation-jit.md operations + security

Incremental rollout sequence (Phase 8A)

  1. Publish repo-contract.schema.json and validate one existing repo.
  2. Add permissions-matrix.yaml with read-only defaults; run one non-destructive orchestration test.
  3. Add runtime-policy.yaml; validate routing for one local and one cloud-eligible task.
  4. Add security-privacy-baseline.v1.md and credential-lifecycle-policy.yaml; perform one local project compliance attestation.
  5. Add credential runbooks and execute one controlled provisioning + JIT + rotation simulation.
  6. Add release-policy.md; execute one Stage 0 → Stage 1 promotion dry run.
  7. Add remaining runbooks/* and audit-log-spec.md; perform one failure-recovery tabletop exercise.

Acceptance checks (Phase 8A)

  • Every repo in the namespace can be validated against repo-contract.schema.json.
  • No orchestration write action occurs without a permissions allowance and approvals.
  • One end-to-end dry run is reproducible by following runbooks only.
  • Audit output conforms to audit-log-spec.md.
  • Every local project maps to a declared security-privacy-baseline version and passes attestation.
  • No agent can read user-level credentials from the user-only secret store.
  • Agent credentials are scoped, time-bounded, and rotatable with tested JIT issuance and revocation paths.

Self-validation snippet

The control plane includes a quick consistency check (run from the workspace root):

python3 - <<'PY'
import json, sys, pathlib
schema = json.loads(pathlib.Path("governance/repo-contract.schema.json").read_text())
required = {"repo_type","name","compatibility","paths","automation"}
missing = required - set(schema.get("required", []))
sys.exit(0 if not missing else f"FAIL: missing required: {missing}")
PY