Skip to content

Onboard a New Project Repo

Deterministic onboarding into the namespace.

Prerequisites

  • The project repo exists in the namespace.
  • The repo declares a repo-contract.json validating against ../repo-contract.schema.json.
  • The orchestration agent has read-only access to the repo.
  • A security-attestation.md is present at the repo root (per SPB-13).

Steps

  1. Register. Add the repo to the orchestration registry with its repo type and contract version. Audit event: register_project_repo (SPB-12).
  2. Validate contract. Run the orchestration validator against the repo. Read-only; produces a signed validation artifact.
  3. Bootstrap rules. If the repo has a rules-manifest.yaml, run /rules-bootstrap (Phase 3). Receipt committed.
  4. Provision credentials. For each declared agent integration, follow agent-credential-provisioning.md. Credentials are agent-scoped (SPB-02) and runtime-injected only.
  5. Attest baseline. Verify security-attestation.md is current. If not, fail back to the project owner.
  6. First dry-run. Trigger one non-destructive automation (automation.validate.command). Confirm exit success and audit event captured.
  7. Mark Stage 0. Project is now experimental-stage onboarded.

Failure handling

  • Any step failure halts onboarding and emits an audit event.
  • Project owner receives a checklist of remediation items.
  • Re-run onboarding only after remediation is recorded.