{
  "schema": "service-lasso.secrets-capability-ledger.v1",
  "observedAt": "2026-09-11T17:20:00Z",
  "programmeSources": [
    "https://github.com/service-lasso/service-lasso/issues/871",
    "https://github.com/service-lasso/service-lasso/issues/872",
    "https://github.com/service-lasso/service-lasso/issues/1151",
    "https://github.com/service-lasso/service-lasso/issues/1164",
    "https://github.com/service-lasso/service-lasso/issues/1208",
    "https://github.com/service-lasso/lasso-secretsbroker/issues/169",
    "https://github.com/service-lasso/lasso-secretsbroker/issues/176",
    "https://github.com/service-lasso/lasso-serviceadmin/issues/578",
    "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
  ],
  "maturityDefinitions": {
    "planned": "A governed target or decision exists, but no usable implementation is proven.",
    "read-only": "A live read path is implemented, but mutation or end-to-end operation is not proven.",
    "dry-run": "The system can validate or plan without committing the durable operation.",
    "executable": "The operation has an implementation path, but required real-process evidence is incomplete.",
    "validated": "Row-specific real-process evidence proves the required cross-repository path and platforms.",
    "excluded": "A recorded Release 1 product decision makes the capability unavailable and forbids a GA claim."
  },
  "releaseWaves": {
    "release-1": "Production-grade local encrypted-store product; every row must be validated or explicitly excluded before GA",
    "release-2": "External provider lifecycle",
    "release-3": "Remote mutation and campaigns",
    "release-4": "Automation",
    "enterprise": "Enterprise or compliance track"
  },
  "capabilities": [
    {
      "id": "vault-bootstrap-root-custody",
      "family": "bootstrap-and-custody",
      "capability": "First-run vault bootstrap and root identity custody",
      "operation": "initialize, supply or generate the root key, reveal once, and recover",
      "owner": {
        "repository": "service-lasso/lasso-secretsbroker",
        "issueUrl": "https://github.com/service-lasso/lasso-secretsbroker/issues/127"
      },
      "endpointSchema": ["Broker bootstrap and recovery contract"],
      "providerBackend": ["local encrypted store", "platform custody"],
      "maturity": "validated",
      "securityPermissionAudit": ["one-time reveal", "no key in durable logs", "authenticated local IPC", "recovery events audited"],
      "adminSurface": "Released Admin first-run setup initializes the exact released Broker, displays the one-time local-operator envelope, requires acknowledgement, authenticates local-root, and starts the linked consumer.",
      "automatedValidation": ["Published-package qualification firstRun and noLeak scenarios on Windows, Linux, and macOS", "Released Admin real first-run browser contract and canonical released-artifact bootstrap/restart readback"],
      "evidence": [
        {
          "kind": "issue",
          "url": "https://github.com/service-lasso/lasso-secretsbroker/issues/127",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Broker foundation issue is closed, which proves delivery history but not current cross-repository validation."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "Exact published Core 2026.9.11-462f837, Admin 2026.8.31-f015b44, and Broker 2026.8.31-f340883 pass first-run, acknowledgement, restart, persistence, and no-leak browser qualification on Windows, Linux, and macOS."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Preserve one-time reveal, recovery custody, and no-leak coverage in every replacement release qualification."
    },
    {
      "id": "pgp-bootstrap-option",
      "family": "bootstrap-and-custody",
      "capability": "PGP-assisted secure bootstrap decision",
      "operation": "decide and, if accepted, design an offline-key bootstrap flow without a hosted key directory",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["decision-only"],
      "providerBackend": ["PGP client or deliberately excluded"],
      "maturity": "excluded",
      "securityPermissionAudit": ["offline private-key custody", "recipient verification", "one-time ciphertext handling"],
      "adminSurface": "PGP bootstrap is unavailable and hidden; Release 1 uses only the approved age/recovery model.",
      "automatedValidation": ["Ledger validation enforces the explicit exclusion and non-claim"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic asks whether PGP bootstrap is a secure supported option."
        },
        {
          "kind": "release-decision",
          "url": "https://github.com/service-lasso/service-lasso/issues/1164",
          "observedAt": "2026-08-31T01:40:30Z",
          "claim": "Release 1 explicitly excludes PGP bootstrap and retains the existing age/recovery model."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Keep PGP bootstrap unavailable and preserve the age/recovery non-claim in product UI, docs, and acceptance evidence."
    },
    {
      "id": "local-encrypted-store-policy",
      "family": "local-store",
      "capability": "Local encrypted store, resolution, writeback, and service policy",
      "operation": "resolve and persist service-owned secret references under declared policy",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/871"
      },
      "endpointSchema": ["service.json broker imports", "Core Broker client"],
      "providerBackend": ["local encrypted store"],
      "maturity": "validated",
      "securityPermissionAudit": ["service-scoped authorization", "metadata-only audit", "no secret values in Core persistence"],
      "adminSurface": "Released Admin policy, inventory, provider, and service surfaces use the same service-scoped contract and keep values out of Core persistence and retained evidence.",
      "automatedValidation": ["Published-package qualification trustedLifecycle, providerReadiness, persistence, durableAudit, and noLeak scenarios on Windows, Linux, and macOS"],
      "evidence": [
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/runtime/broker/client.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The observed Core baseline implements allowlisted Broker operations; current end-to-end release evidence remains row-specific."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "Released Admin-to-Core-to-Broker policy-compatible local-store resolution, writeback, restart persistence, durable audit, and no-leak behavior pass on all three supported platforms."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Keep service-scoped authorization and metadata-only persistence in the replacement-release matrix."
    },
    {
      "id": "generated-credentials",
      "family": "local-store",
      "capability": "Generated service credentials",
      "operation": "generate, persist, and inject credentials without exposing values outside the Broker boundary",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/806"
      },
      "endpointSchema": ["service.json generated credential declaration"],
      "providerBackend": ["local encrypted store"],
      "maturity": "validated",
      "securityPermissionAudit": ["no plaintext persistence", "no log or protocol disclosure", "service-scoped access"],
      "adminSurface": "Released first-run setup provisions declared generated credentials and the inventory exposes metadata while the linked sample consumer starts without revealing values.",
      "automatedValidation": ["Published-package qualification firstRun, comprehensiveLifecycle, persistence, and noLeak scenarios on Windows, Linux, and macOS"],
      "evidence": [
        {
          "kind": "blocked-issue",
          "url": "https://github.com/service-lasso/service-lasso/issues/806",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The issue is open and Project-blocked; ambiguous dirty recovery state is intentionally preserved."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "The exact released product generates declared credentials during first run, starts the linked consumer, preserves the generated reference across restart, and retains metadata-only evidence on all three supported platforms."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Retain the generated-credential first-run and restart contract in every replacement-release matrix; preserve unrelated historical recovery worktrees without using them as evidence."
    },
    {
      "id": "secret-inventory-search-reveal",
      "family": "inventory",
      "capability": "Secret inventory, search, and controlled reveal",
      "operation": "list metadata, filter/search, and reveal only under an explicit controlled action",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["Core Broker inventory and reveal routes"],
      "providerBackend": ["local encrypted store", "configured external providers"],
      "maturity": "validated",
      "securityPermissionAudit": ["separate read and reveal permissions", "confirmation for reveal", "no value in list responses", "reveal audited"],
      "adminSurface": "Released inventory is searchable, filterable, paged, metadata-only by default, and keeps controlled reveal separate from rotation.",
      "automatedValidation": ["Published-package comprehensiveLifecycle, adminBrowser, durableAudit, and noLeak scenarios on Windows, Linux, and macOS", "Exact Admin release focused browser suite: 7/7"],
      "evidence": [
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/server/index.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "Core exposes Broker-facing secrets routes on the observed baseline."
        },
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic requires the standard table, search, pagination, rotate-without-reveal, and delete semantics."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "The exact released Admin inventory passes list, search, pagination, controlled reveal, independent rotation, durable audit, and no-leak checks through the released Core and Broker on all supported platforms."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Keep metadata-only list, audited reveal, search/paging, and rotate-without-reveal in the release matrix."
    },
    {
      "id": "local-secret-lifecycle",
      "family": "inventory",
      "capability": "Local secret create, edit, reset, decommission, and policy",
      "operation": "mutate local secrets with explicit authorization, confirmation, audit, and honest deletion semantics",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/871"
      },
      "endpointSchema": ["Core Broker mutation allowlist"],
      "providerBackend": ["local encrypted store"],
      "maturity": "validated",
      "securityPermissionAudit": ["mutation permission", "confirmation for destructive action", "durable audit", "no value in response logs"],
      "adminSurface": "Released inventory actions map create, edit, reset, decommission, tombstone restore, and policy checks to explicit Broker contracts with confirmation and audit.",
      "automatedValidation": ["Published-package comprehensiveLifecycle, rollback, persistence, durableAudit, noLeak, and stoppedLifecycle scenarios on Windows, Linux, and macOS"],
      "evidence": [
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/runtime/broker/client.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "Core allowlists local lifecycle requests on the observed baseline."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "Exact released Admin-to-Core-to-Broker create, edit, reset, decommission, tombstone recovery, restart persistence, failure, and durable-audit paths pass on Windows, Linux, and macOS."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Preserve the exact action-to-contract map and tombstone recovery behavior in replacement-release qualification."
    },
    {
      "id": "linked-secret-rotation",
      "family": "rotation",
      "capability": "Linked-secret rotation with consumer owner action and rollback",
      "operation": "plan, execute, report, and recover a Broker mutation plus consumer-side owner action",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/887"
      },
      "endpointSchema": ["rotation plan", "rotation execute", "rotation status", "service.json rotationOwner"],
      "providerBackend": ["local encrypted store", "provider-backed secret where the Broker reports executable capability"],
      "maturity": "validated",
      "securityPermissionAudit": ["mutation permission", "owner action approval", "metadata-only idempotency", "compensating action", "durable audit"],
      "adminSurface": "Released Admin visibly separates dry-run, confirmed apply, owner action, rollback, retirement, and terminal outcome; mutation is exactly once.",
      "automatedValidation": ["Published-package comprehensiveLifecycle, brokerContinuity, trustedLifecycle, rollback, persistence, durableAudit, and noLeak scenarios on Windows, Linux, and macOS"],
      "evidence": [
        {
          "kind": "core-pull-request",
          "url": "https://github.com/service-lasso/service-lasso/pull/1132",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The owner-action policy slice is open in review at commit 7fc2313f8d7b8086728088ee7edac0a627eb99d1."
        },
        {
          "kind": "admin-pull-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/pull/569",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "Admin qualification head 2da98da1934a1167b509217982d8a58cba154102 passes Linux and macOS but fails Windows after rotation when provider status returns HTTP 503."
        },
        {
          "kind": "failing-check",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/actions/runs/32788590051/job/97625485909",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Windows real-browser gate is terminally failing, so the cross-repository path is not validated."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "The superseding exact-publication matrix passes linked rotation, owner action, rollback, retirement, restart persistence, durable audit, and exactly-once mutation on all three supported platforms."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Keep superseded failing runs linked as history and require one terminal-green exact-publication matrix for any replacement release."
    },
    {
      "id": "backup-restore-master-key-recovery",
      "family": "custody-and-recovery",
      "capability": "Backup, restore, master-key rotation, and recovery shares",
      "operation": "create and verify protected backups, restore state, rotate the master key, and recover under quorum policy",
      "owner": {
        "repository": "service-lasso/lasso-secretsbroker",
        "issueUrl": "https://github.com/service-lasso/lasso-secretsbroker/issues/134"
      },
      "endpointSchema": ["Broker backup and restore contract", "Core backup and restore routes"],
      "providerBackend": ["local encrypted store"],
      "maturity": "validated",
      "securityPermissionAudit": ["separate backup and restore permissions", "confirmation", "integrity verification", "key material never logged", "durable audit"],
      "adminSurface": "Released Operations/recovery surfaces require integrity verification, confirmed restore, restart verification, master-key rewrap, and a new verified backup.",
      "automatedValidation": ["Published-package comprehensiveLifecycle, rollback, persistence, durableAudit, and noLeak scenarios on Windows, Linux, and macOS"],
      "evidence": [
        {
          "kind": "issue",
          "url": "https://github.com/service-lasso/lasso-secretsbroker/issues/134",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Broker implementation issue is closed; closure alone does not establish current live compatibility."
        },
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/runtime/cli/secrets.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The observed Core CLI includes backup and restore commands."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "Exact released artifacts pass encrypted backup creation, integrity verification, confirmed restore, master-key rotation and rewrap, replacement backup, restart verification, rollback, and no-leak checks on all three platforms."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Retain destructive-safe temporary-store restore, integrity, key rotation, replacement-backup, and restart checks in the release matrix."
    },
    {
      "id": "audit-telemetry-diagnostics",
      "family": "operations",
      "capability": "Durable audit, telemetry, and diagnostics",
      "operation": "record metadata-only security events and expose operational health without secret material",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["Core audit and readiness routes", "Broker telemetry contract"],
      "providerBackend": ["Core audit store", "Broker event and telemetry sources"],
      "maturity": "validated",
      "securityPermissionAudit": ["audit-read permission", "tamper-evidence meaning documented", "secret-value redaction", "failure must not silently authorize mutation"],
      "adminSurface": "Operations navigation with separate Telemetry and Audit pages.",
      "automatedValidation": ["Published-package durableAudit, noLeak, brokerContinuity, and adminBrowser scenarios on Windows, Linux, and macOS", "Exact Admin release Operations navigation checks"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic requires Operations navigation, Telemetry, and Audit for Core and Broker."
        },
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/server/index.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "Core exposes audit and readiness surfaces on the observed baseline."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "Released Core, Broker, and Admin pass durable, restart-persistent, permission-scoped, redacted audit and telemetry browser contracts on Windows, Linux, and macOS."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Keep durable-audit failure behavior, redaction sentinels, restart persistence, and Operations pages in replacement-release checks."
    },
    {
      "id": "events-lockouts-filtering",
      "family": "operations",
      "capability": "Event notifications, user lockout, and filtering",
      "operation": "publish filterable events and enforce identity lockout policy",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["Broker telemetry and event filters", "exact-scope lockout-clear contract"],
      "providerBackend": ["Broker identity and event subsystems"],
      "maturity": "validated",
      "securityPermissionAudit": ["identity-bound authorization", "lockout administration", "event subscription permission", "audit of policy changes"],
      "adminSurface": "Released Operational controls expose filterable metadata-only events and an explicitly confirmed exact-scope lockout clear with a durable event.",
      "automatedValidation": ["Published-package localOperatorLockout on Windows plus durableAudit, noLeak, and adminBrowser on all three platforms", "Released Admin exact real-lockout browser contract"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic explicitly asks for lockout, events, and filtering."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "The exact released Windows path induces and clears the active local API lockout once under confirmation, then filters and renders its durable metadata-only event; cross-platform event, audit, and no-leak paths also pass."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Retain exact-scope identity, confirmation, filter, durability, and redaction checks; expand native lockout induction beyond Windows if the platform contract widens."
    },
    {
      "id": "service-secret-provider-topology",
      "family": "topology",
      "capability": "Service, secret, and provider topology with startup impact",
      "operation": "show dependency edges, affected startups, and searchable topology",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["Core service catalog and secret impact data"],
      "providerBackend": ["all configured providers"],
      "maturity": "validated",
      "securityPermissionAudit": ["metadata-only topology", "service visibility permission", "no secret values or credential identifiers beyond authorization"],
      "adminSurface": "Topology graph with search and startup-impact details.",
      "automatedValidation": ["Published-package runtimeDashboardServices, adminBrowser, and noLeak scenarios on Windows, Linux, and macOS", "Exact Admin release Topology navigation/layout/search checks: 57/57 focused assertions and 7/7 focused browser cases"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic requires topology search and a Routes page."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "The released Admin consumes exact runtime service and provider metadata on all three platforms; focused exact-release browser checks prove the dedicated Topology page, deep link, search/layout, and no-secret-material boundaries."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Preserve runtime-backed topology, search/layout, empty/error, startup-impact, and redaction checks in replacement releases."
    },
    {
      "id": "routes-and-traefik-view",
      "family": "topology",
      "capability": "Service routes and Traefik configuration view",
      "operation": "show every declared service route and the routing intent Core applies",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["service route inventory contract"],
      "providerBackend": ["Core service catalog", "Traefik integration"],
      "maturity": "validated",
      "securityPermissionAudit": ["route-read permission", "redact sensitive query or header configuration", "metadata-only audit as required"],
      "adminSurface": "Separate Routes page using the standard searchable and paged table.",
      "automatedValidation": ["Published-package runtimeDashboardServices, adminBrowser, and noLeak scenarios on Windows, Linux, and macOS", "Exact Admin release Routes navigation and help-coverage checks in the 57/57 focused assertion run"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic explicitly requests a Routes page showing service routes and Traefik intent."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "The exact released Admin consumes the released runtime service/route data on all three platforms, while the exact-release focused checks prove the dedicated Routes navigation, documentation coverage, and metadata-only rendering contract."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Keep the dedicated Routes surface bound to exact runtime metadata and preserve query/header redaction checks."
    },
    {
      "id": "provider-status-configuration",
      "family": "external-providers",
      "capability": "Provider status, capability, validation, configuration, reconnect, enable, disable, and remove",
      "operation": "inspect and manage provider lifecycle using capability-gated actions",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/871"
      },
      "endpointSchema": ["Core Broker provider status and configuration routes"],
      "providerBackend": ["Vault/OpenBao", "AWS provider", "configured Broker providers"],
      "maturity": "executable",
      "securityPermissionAudit": ["provider-read and provider-admin permissions", "confirmation for disable/remove", "credentials never returned", "durable audit"],
      "adminSurface": "Provider list, status, capability-gated actions, configuration, and reconnect.",
      "automatedValidation": ["Admin pull request #569 real-browser matrix"],
      "evidence": [
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/runtime/broker/client.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "Core allowlists provider status and configuration operations."
        },
        {
          "kind": "failing-check",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/actions/runs/32788590051/job/97625485909",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The active Windows Admin qualification fails when post-rotation provider status returns HTTP 503."
        }
      ],
      "releaseWave": "release-2",
      "blocker": "The Windows real-browser provider-status gate is failing after rotation.",
      "nextAction": "Correct the Windows post-rotation provider-status path and rerun the exact cross-platform matrix."
    },
    {
      "id": "external-secret-read-reveal",
      "family": "external-providers",
      "capability": "External provider secret read and controlled reveal",
      "operation": "read external metadata and reveal only when the provider and caller permissions allow it",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/871"
      },
      "endpointSchema": ["Broker inventory and reveal contracts with provider capability metadata"],
      "providerBackend": ["Vault/OpenBao", "AWS provider"],
      "maturity": "read-only",
      "securityPermissionAudit": ["provider and caller permission intersection", "controlled reveal", "no value caching in Core/Admin", "audit"],
      "adminSurface": "Provider-backed inventory with disabled actions when reveal is unsupported.",
      "automatedValidation": ["source-level provider and Core tests; no complete current Admin real-process evidence"],
      "evidence": [
        {
          "kind": "programme",
          "url": "https://github.com/service-lasso/service-lasso/issues/871",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "Release 2 requires external read/reveal and honest executable-capability gating."
        }
      ],
      "releaseWave": "release-2",
      "blocker": "No provider-specific row proves permissions, capability gating, reveal redaction, and live Admin compatibility.",
      "nextAction": "Qualify external metadata and reveal separately for each supported provider."
    },
    {
      "id": "remote-secret-mutation-migration",
      "family": "external-providers",
      "capability": "External write, update, rotate, policy, and provider migration",
      "operation": "mutate provider-backed secrets and migrate with retry, recovery, and partial-failure truth",
      "owner": {
        "repository": "service-lasso/lasso-secretsbroker",
        "issueUrl": "https://github.com/service-lasso/lasso-secretsbroker/issues/162"
      },
      "endpointSchema": ["Broker provider mutation and migration contracts"],
      "providerBackend": ["Vault/OpenBao", "AWS provider"],
      "maturity": "executable",
      "securityPermissionAudit": ["provider capability and mutation permission", "confirmation", "idempotency", "partial-failure audit", "recovery"],
      "adminSurface": "Mutation and migration actions remain capability-gated until provider-specific validation exists.",
      "automatedValidation": ["Broker issue #162 is in review; no completed cross-repository release gate is recorded"],
      "evidence": [
        {
          "kind": "issue",
          "url": "https://github.com/service-lasso/lasso-secretsbroker/issues/162",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Broker provider-lifecycle work is open and in review."
        }
      ],
      "releaseWave": "release-3",
      "blocker": "Provider-specific mutation, partial-failure, retry, and recovery evidence is not terminal across the product path.",
      "nextAction": "Finish Broker review and add exact-provider Admin-to-Core-to-Broker mutation and recovery qualification."
    },
    {
      "id": "bulk-rotation-campaigns",
      "family": "campaigns",
      "capability": "Bulk rotation campaigns",
      "operation": "plan, start, observe, retry, and recover multi-secret campaigns",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/871"
      },
      "endpointSchema": ["Broker campaign routes through the Core client"],
      "providerBackend": ["local encrypted store", "capable external providers"],
      "maturity": "executable",
      "securityPermissionAudit": ["campaign permission", "approval and scope preview", "idempotency", "per-item audit", "partial failure retained"],
      "adminSurface": "Campaign planner and status views must distinguish planned, applied, failed, retried, and recovered items.",
      "automatedValidation": ["Core client allowlist; no current product-wide campaign recovery qualification"],
      "evidence": [
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/runtime/broker/client.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "Core allowlists Broker campaign operations on the observed baseline."
        }
      ],
      "releaseWave": "release-3",
      "blocker": "No exact-version real-process gate proves partial failure, retry, restart, and recovery across a mixed campaign.",
      "nextAction": "Add a deterministic mixed-success provider campaign qualification with restart-safe retry and audit assertions."
    },
    {
      "id": "headless-cli-secrets",
      "family": "automation",
      "capability": "Headless Secrets CLI",
      "operation": "audit, check readiness, authenticate providers, plan rotation, and perform supported recovery operations",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/871"
      },
      "endpointSchema": ["Core secrets CLI"],
      "providerBackend": ["Broker through Core"],
      "maturity": "dry-run",
      "securityPermissionAudit": ["non-interactive identity", "least privilege", "no secret output by default", "machine-readable failures", "audit"],
      "adminSurface": "Not applicable; documentation must not imply CLI execute/status parity that is absent.",
      "automatedValidation": ["Core CLI tests"],
      "evidence": [
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/runtime/cli/secrets.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The observed CLI exposes audit, readiness, provider authentication, rotation planning, backup, and restore, but not rotation execute/status parity."
        }
      ],
      "releaseWave": "release-4",
      "blocker": "Mutation parity, stable machine output, identity/approval controls, and installed-artifact evidence are incomplete.",
      "nextAction": "Define the supported headless contract and add execute/status only with identity, approval, audit, and installed-artifact qualification."
    },
    {
      "id": "core-mcp-read-tools",
      "family": "automation",
      "capability": "Service Lasso MCP server",
      "operation": "expose permission-scoped operator reads and guarded service lifecycle actions through Streamable HTTP and stdio",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/864"
      },
      "endpointSchema": ["Core operator MCP tools, resources, Streamable HTTP, stdio, and OAuth protected-resource metadata"],
      "providerBackend": ["Core runtime metadata"],
      "maturity": "validated",
      "securityPermissionAudit": ["signed identity", "issuer, audience, actor, and scope validation", "Origin, Host, and DNS-rebinding boundaries", "actor and client rate limits", "permission profiles", "confirmation and idempotency", "durable operations", "metadata-only Audit", "no secret or path leakage"],
      "adminSurface": "No Admin management claim; operators use the documented MCP client surface in read-only or explicitly enabled guarded mode.",
      "automatedValidation": ["npm run test:mcp:product", "npm run verify:mcp:packaged", "MCP Product Acceptance workflow on Windows, Linux, and macOS", "Release Qualification mcp-product-source blocking job", "npm run demo:verify-canonical"],
      "evidence": [
        {
          "kind": "real-process-gate",
          "url": "https://github.com/service-lasso/service-lasso/actions/workflows/mcp-product-acceptance.yml",
          "observedAt": "2026-08-29T15:21:29Z",
          "claim": "The blocking workflow validates official SDK and Inspector protocol behavior plus fresh-package HTTP and stdio operation on Windows, Linux, and macOS, with exact-SHA 90-day metadata artifacts."
        },
        {
          "kind": "programme-acceptance",
          "url": "https://github.com/service-lasso/service-lasso/issues/864",
          "observedAt": "2026-08-29T15:21:29Z",
          "claim": "SPEC-006 AC-6G defines the supported release-gated identity, safety, durable-operation, packaging, documentation, and canonical-verifier boundary."
        }
      ],
      "releaseWave": "release-4",
      "blocker": null,
      "nextAction": "Keep the exact-SHA source, three-OS fresh-package, retained-artifact, and canonical-verifier gates blocking for every supported MCP change."
    },
    {
      "id": "broker-mcp-management",
      "family": "automation",
      "capability": "Secrets Broker MCP management tools",
      "operation": "manage secrets through explicit permission and human-approval controls",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["not defined"],
      "providerBackend": ["Broker providers"],
      "maturity": "planned",
      "securityPermissionAudit": ["tool-specific scopes", "human approval for mutation/reveal", "provider permission intersection", "durable audit", "no secret in model context"],
      "adminSurface": "Approval and audit UX is not designed; no enabled management tools should be claimed.",
      "automatedValidation": ["none recorded"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic asks for a Secrets Broker MCP server."
        }
      ],
      "releaseWave": "release-4",
      "blocker": "No accepted protocol, identity, scope, approval, audit, and secret-boundary design exists.",
      "nextAction": "Create a threat-modelled Broker MCP spec before implementing tools or UI."
    },
    {
      "id": "secrets-sync-github",
      "family": "automation",
      "capability": "Secrets Sync, including GitHub target",
      "operation": "preview and eventually synchronize selected secret material to an approved target",
      "owner": {
        "repository": "service-lasso/service-lasso",
        "issueUrl": "https://github.com/service-lasso/service-lasso/issues/871"
      },
      "endpointSchema": ["Broker sync dry-run contract"],
      "providerBackend": ["GitHub target", "future approved targets"],
      "maturity": "dry-run",
      "securityPermissionAudit": ["source and target permission", "explicit scope preview", "target credential isolation", "no value in logs", "durable audit"],
      "adminSurface": "Preview-only until apply, retry, and reconciliation are independently proven.",
      "automatedValidation": ["Core Broker client supports sync dry-run; live apply evidence is absent"],
      "evidence": [
        {
          "kind": "source",
          "url": "https://github.com/service-lasso/service-lasso/blob/ba709db2f00df5d48cdf92b4ebcd46fbdcd6eced/src/runtime/broker/client.ts",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The observed Core client allowlists a sync dry-run operation, not a validated apply path."
        },
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic requests Secrets Sync to GitHub."
        }
      ],
      "releaseWave": "release-4",
      "blocker": "Only dry-run is evidenced; target authentication, write, retry, drift, deletion, and recovery behavior are not accepted.",
      "nextAction": "Specify GitHub target semantics and qualify preview before authorizing a separate apply slice."
    },
    {
      "id": "scheduled-automated-rotation",
      "family": "automation",
      "capability": "Scheduled and automated credential rotation",
      "operation": "schedule rotation and safely reconcile unattended provider and consumer updates",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["not defined"],
      "providerBackend": ["capability-compatible providers"],
      "maturity": "planned",
      "securityPermissionAudit": ["scheduler identity", "bounded scope", "approval policy", "idempotency", "rollback", "durable audit"],
      "adminSurface": "Schedule, pause, history, failure, and recovery UX remains a future governed slice.",
      "automatedValidation": ["none recorded"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic requests automated credential rotation."
        }
      ],
      "releaseWave": "release-4",
      "blocker": "Interactive rotation and owner-action rollback are not yet validated, and no scheduler identity/approval contract exists.",
      "nextAction": "Finish interactive rotation qualification, then specify scheduler identity, approval, retry, rollback, and audit behavior."
    },
    {
      "id": "vault-openbao-aws-provider-tracks",
      "family": "enterprise-providers",
      "capability": "Vault/OpenBao and AWS provider tracks",
      "operation": "authenticate, report capability, read, and perform explicitly supported provider lifecycle operations",
      "owner": {
        "repository": "service-lasso/lasso-secretsbroker",
        "issueUrl": "https://github.com/service-lasso/lasso-secretsbroker/issues/162"
      },
      "endpointSchema": ["Broker provider contract"],
      "providerBackend": ["Vault/OpenBao", "AWS provider"],
      "maturity": "executable",
      "securityPermissionAudit": ["provider-specific identity", "least privilege", "capability discovery", "credential redaction", "audit"],
      "adminSurface": "Provider actions must be driven by reported capabilities and exact validation state.",
      "automatedValidation": ["Provider work is in review; no complete cross-repository provider matrix is recorded"],
      "evidence": [
        {
          "kind": "issue",
          "url": "https://github.com/service-lasso/lasso-secretsbroker/issues/162",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The provider track remains open and in review."
        }
      ],
      "releaseWave": "enterprise",
      "blocker": "Provider-specific identity, mutation, retry, and real-process compatibility evidence is incomplete.",
      "nextAction": "Maintain separate provider matrices and never infer one provider's capability or evidence for another."
    },
    {
      "id": "enterprise-mfa-hsm-fips",
      "family": "enterprise-controls",
      "capability": "MFA, HSM custody, and FIPS compliance",
      "operation": "enforce strong authentication, hardware-backed custody, and a defined validated cryptographic boundary",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["not defined"],
      "providerBackend": ["approved HSM", "FIPS-validated cryptographic module", "identity provider"],
      "maturity": "planned",
      "securityPermissionAudit": ["MFA policy", "hardware key custody", "validated module/version boundary", "administrative audit"],
      "adminSurface": "No availability or compliance claim until certified scope and implementation evidence exist.",
      "automatedValidation": ["none recorded"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic asks about MFA, HSM support, and FIPS compliance."
        }
      ],
      "releaseWave": "enterprise",
      "blocker": "No accepted product scope, certification boundary, supported hardware, or implementation issue exists.",
      "nextAction": "Record separate product decisions and evidence requirements for MFA, HSM, and FIPS before scheduling implementation."
    },
    {
      "id": "admin-navigation-page-split-tables",
      "family": "admin-product",
      "capability": "Admin navigation, page split, and standard data tables",
      "operation": "rename navigation, flatten Secrets pages, and use searchable, filterable, paged tables",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["Admin route and presentation model"],
      "providerBackend": ["not applicable"],
      "maturity": "validated",
      "securityPermissionAudit": ["page-level authorization", "no secret value in list models", "disabled actions reflect live capability"],
      "adminSurface": "Rename the requested section, flatten the duplicate Secrets Broker group, split hash sections into pages, and use the shared table component.",
      "automatedValidation": ["Published-package adminBrowser and noLeak scenarios on Windows, Linux, and macOS", "Exact Admin release focused navigation/table checks: 57/57 assertions and 7/7 browser cases", "Exact Admin release real-browser run 33437554122 on Windows, Linux, and macOS"],
      "evidence": [
        {
          "kind": "admin-pull-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/pull/551",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The draft Admin work is open and its real-browser matrix is failing."
        },
        {
          "kind": "admin-pull-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/pull/557",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin product-decision cleanup is open and its real-browser matrix is failing."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "Superseding released-artifact qualification passes the exact released Admin navigation and lifecycle surfaces on all three platforms; focused exact-release checks prove the flattened Secrets pages, dedicated pages, standard tables, deep links, and removed-route redirects."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Keep navigation identity, deep links, table behavior, removed-route redirects, and no-blank/no-secret browser checks in replacement releases."
    },
    {
      "id": "admin-product-decisions",
      "family": "admin-product",
      "capability": "Sessions, Fleet, Support Bundle, and Policy Simulation decisions",
      "operation": "retain, defer, or remove each surface with an explicit product and contract rationale",
      "owner": {
        "repository": "service-lasso/lasso-serviceadmin",
        "issueUrl": "https://github.com/service-lasso/lasso-serviceadmin/issues/97"
      },
      "endpointSchema": ["decision-only"],
      "providerBackend": ["identity provider for Sessions", "on-prem service inventory for Fleet", "Core diagnostics for Support Bundle", "service.json policy for Policy Simulation"],
      "maturity": "validated",
      "securityPermissionAudit": ["least-data product scope", "support-bundle redaction", "policy decisions must not imply enforcement"],
      "adminSurface": "Retire or hide Fleet and Sessions; ZITADEL owns sessions. Replace Policy Simulation with actual service-manifest secret-access assignments. Keep Support Bundle hidden or preview until redaction and released-artifact evidence pass.",
      "automatedValidation": ["Exact Admin release surface and sidebar assertions: 57/57 focused assertions", "Exact Admin release focused browser suite: 7/7", "Published-package adminBrowser and noLeak scenarios on Windows, Linux, and macOS"],
      "evidence": [
        {
          "kind": "programme-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/issues/97",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "The Admin epic asks explicit keep/remove questions for Sessions, Fleet, Support Bundle, and Policy Simulation."
        },
        {
          "kind": "admin-pull-request",
          "url": "https://github.com/service-lasso/lasso-serviceadmin/pull/557",
          "observedAt": "2026-08-25T04:14:10Z",
          "claim": "An open Admin pull request proposes retiring Sessions and Fleet, but it is not merged or fully qualified."
        },
        {
          "kind": "release-decision",
          "url": "https://github.com/service-lasso/service-lasso/issues/1164",
          "observedAt": "2026-08-31T01:40:30Z",
          "claim": "Release 1 retires Fleet and Sessions, assigns sessions to ZITADEL, and replaces Policy Simulation with manifest-backed secret-access assignments."
        },
        {
          "kind": "real-process-qualification",
          "url": "https://github.com/service-lasso/service-lasso/actions/runs/34625492347",
          "observedAt": "2026-09-11T17:20:00Z",
          "claim": "The exact released Admin passes the released-product browser and no-leak matrix on all three platforms; focused exact-release checks prove Fleet, Sessions, Policy Simulation, and Support Bundle are absent from shipped navigation and legacy routes redirect to the governed replacements."
        }
      ],
      "releaseWave": "release-1",
      "blocker": null,
      "nextAction": "Preserve the retired/hidden surface assertions, governed redirects, ZITADEL ownership statement, and manifest-backed secret-access replacement in every release."
    }
  ]
}