Discover 32 CI/CD capabilities through an eight-clade visitor atlas

.github/workflows/secret-scanner-self-test.yml

@@ -24,6 +24,10 @@ jobs:
           yq '.' .github/workflows/secret-scanner-reusable.yml >/dev/null
           yq '.' templates/secret-scanner-caller.yml >/dev/null
           yq '.' actions/secret-scan-check/action.yml >/dev/null
+      - name: Capability atlas inventory, navigation and negative controls
+        run: |
+          bash scripts/build-capability-catalogue.sh --check
+          bash tests/capability-catalogue.sh
       - name: Governance pin representation regressions (not full lock verification)
         run: bash tests/lock-pin-contract.sh
       - name: Official SonarCloud receipt regressions

CATALOGUE.adoc

@@ -0,0 +1,208 @@
+// SPDX-License-Identifier: CC-BY-SA-4.0
+// Generated by scripts/build-capability-catalogue.sh; edit catalogue/capabilities.json.
+= The CI/CD Capability Atlas
+:toc:
+:toclevels: 2
+
+*Repository assurance, organised by purpose. Discover by clade; choose by nature; adopt with evidence.*
+
+*32 composite actions · 8 clades · two independent discovery axes.*
+
+This is a visitor-facing product catalogue, not a repo-chora file, a BoJ cartridge implementation, or a certification scheme. Inspired by BoJ's separation of capability domain from interface/type, it groups existing CI/CD building blocks without moving their paths or changing their behaviour.
+
+== Find your route
+
+* *Protect credentials:* <<sentinel,Sentinel>> — bounded secret scanning and authoritative result receipts.
+* *Establish repository policy:* <<covenant,Covenant>>, <<forge,Forge>> and <<schema,Schema>>.
+* *Compile, test or prove:* <<proof,Proof>> — language-specific execution and explicitly labelled source checks.
+* *Integrate the ecosystem:* <<bridge,Bridge>> — BoJ applicability, Pons and Panic Attack.
+* *Explore signals and future work:* <<observatory,Observatory>> and <<frontier,Frontier>> — no inflated assurance claims.
+
+== The clade matrix
+
+[cols="2,4,1,1,1,1,1",options="header"]
+|===
+|Clade |Purpose |Total |Enforcing |Tool-dependent |Advisory |Stub
+|<<sentinel,Sentinel — security & trusted results>> |Find exposed credentials and verify authoritative analysis without manufacturing a green result. |4 |4 |0 |0 |0
+|<<covenant,Covenant — governance & provenance>> |Establish repository identity, policy documents, attribution and licensing. |4 |4 |0 |0 |0
+|<<forge,Forge — source & build hygiene>> |Control source debt, document formats, language policy and task-runner syntax. |4 |4 |0 |0 |0
+|<<schema,Schema — manifests & contracts>> |Validate structured manifests and executable contract declarations. |2 |1 |1 |0 |0
+|<<proof,Proof — languages & verification>> |Compile, test, inspect interfaces and execute proof tools where applicable. |7 |6 |1 |0 |0
+|<<bridge,Bridge — ecosystem integration>> |Connect BoJ capabilities and external analysis tools to repository checks. |2 |1 |1 |0 |0
+|<<observatory,Observatory — advisory signals>> |Discover useful signals without presenting warnings or heuristics as certification. |7 |0 |0 |7 |0
+|<<frontier,Frontier — unfinished capabilities>> |Visible roadmap boundaries: not implemented assurance and not recommended gates. |2 |0 |0 |0 |2
+|===
+
+== Read the assurance labels
+
+* *Enforcing (20):* can reject a subject. This is not a guarantee of completeness, applicability, production readiness or formal verification.
+* *Tool-dependent (3):* requires explicitly supplied validators/toolchains; inspect applicability and not-run behaviour before adoption.
+* *Advisory (7):* signals and warnings, not an assurance verdict. Some current outputs are simulated or heuristic; each card names the boundary.
+* *Stub (2):* unfinished integration or placeholder. Do not deploy as evidence of a completed check.
+
+Nature is a separate axis: a policy-pattern scan is not a compiler, a receipt verifier is not an analyser, and a proof executor is not a proof that every program is correct. These labels are reviewed inventory metadata; tests enforce coverage and consistency, not semantic correctness of every gate.
+
+== Browse by nature
+
+[cols="2,1,7",options="header"]
+|===
+|Nature |Count |Capabilities
+|advisory |7 |link:actions/badges-check/action.yml[Accreditations & badges] · link:actions/gitsea-check/action.yml[Analytics declarations] · link:actions/hosting-check/action.yml[Hosting configuration] · link:actions/metrics-check/action.yml[Metrics & proof indicators] · link:actions/tests-benches-check/action.yml[Test & benchmark discoverability] · link:actions/trust-humans-check/action.yml[Human trust declarations] · link:actions/www-compliance-check/action.yml[Web & well-known conventions]
+|build-test |2 |link:actions/rust-ci-check/action.yml[Strict Rust CI] · link:actions/kanren-check/action.yml[Relational-code checks]
+|integration |2 |link:actions/boj-cartridge-check/action.yml[BoJ cartridge applicability] · link:actions/custom-tools-check/action.yml[Pons & Panic Attack]
+|placeholder |2 |link:actions/prat-check/action.yml[PRAT testing placeholder] · link:actions/semantic-audit-check/action.yml[Semantic audit placeholder]
+|policy-gate |10 |link:actions/secrets-check/action.yml[Private-key material] · link:actions/vaulted-tokens-check/action.yml[Vaulted token format] · link:actions/required-files-check/action.yml[Repository foundations] · link:actions/spdx-license-check/action.yml[Licensing & SPDX] · link:actions/affirmation-check/action.yml[Affirmation snapshots] · link:actions/code-hygiene-check/action.yml[Source debt & proof escapes] · link:actions/formatting-check/action.yml[Document format policy] · link:actions/linguist-check/action.yml[Language inventory policy] · link:actions/idris2-abi-check/action.yml[Idris2 ABI source policy] · link:actions/zig-unified-api-adapter-check/action.yml[Zig adapter source policy]
+|proof-executor |3 |link:actions/creusot-check/action.yml[Rust deductive verification] · link:actions/spark-check/action.yml[Ada/SPARK proof] · link:actions/proof-runner-check/action.yml[Idris2 & Lean proof runner]
+|receipt-verifier |1 |link:actions/sonarcloud-result-check/action.yml[Authoritative SonarCloud receipt]
+|scanner |1 |link:actions/secret-scan-check/action.yml[Bounded secret scanning]
+|validator |4 |link:actions/referencing-check/action.yml[Citation metadata] · link:actions/recipes-set-check/action.yml[Task-runner syntax] · link:actions/manifest-check/action.yml[DEED & K9 manifests] · link:actions/contractile-validation-check/action.yml[Contractile declarations]
+|===
+
+[[sentinel]]
+== Sentinel — security & trusted results
+
+Find exposed credentials and verify authoritative analysis without manufacturing a green result.
+
+link:catalogue/clades/sentinel.adoc[Explore this clade — 4 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/secret-scan-check/action.yml[Bounded secret scanning] |scanner |enforcing |Redacted working-tree and history scans with checksum-pinned Gitleaks, real detector controls and Rust/shell supplements.
+|link:actions/secrets-check/action.yml[Private-key material] |policy-gate |enforcing |Detect PEM/OpenSSH private-key material in the working tree.
+|link:actions/vaulted-tokens-check/action.yml[Vaulted token format] |policy-gate |enforcing |Enforce the estate token-wrapper representation policy.
+|link:actions/sonarcloud-result-check/action.yml[Authoritative SonarCloud receipt] |receipt-verifier |enforcing |Verify the newest official-app result for an exact repository and commit.
+|===
+
+[[covenant]]
+== Covenant — governance & provenance
+
+Establish repository identity, policy documents, attribution and licensing.
+
+link:catalogue/clades/covenant.adoc[Explore this clade — 4 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/required-files-check/action.yml[Repository foundations] |policy-gate |enforcing |Check required structural documents, substance and repository-specific ownership.
+|link:actions/spdx-license-check/action.yml[Licensing & SPDX] |policy-gate |enforcing |Inspect licence files and estate SPDX conventions.
+|link:actions/affirmation-check/action.yml[Affirmation snapshots] |policy-gate |enforcing |Validate applicable AFFIRMATION snapshots and configured signature trust.
+|link:actions/referencing-check/action.yml[Citation metadata] |validator |enforcing |Validate core Citation File Format fields when applicable.
+|===
+
+[[forge]]
+== Forge — source & build hygiene
+
+Control source debt, document formats, language policy and task-runner syntax.
+
+link:catalogue/clades/forge.adoc[Explore this clade — 4 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/code-hygiene-check/action.yml[Source debt & proof escapes] |policy-gate |enforcing |Find untracked debt markers and undeclared proof circumventions with source-aware rules.
+|link:actions/formatting-check/action.yml[Document format policy] |policy-gate |enforcing |Enforce estate file-format conventions with named exceptions.
+|link:actions/linguist-check/action.yml[Language inventory policy] |policy-gate |enforcing |Inspect language policy and Linguist configuration.
+|link:actions/recipes-set-check/action.yml[Task-runner syntax] |validator |enforcing |Parse-check Justfile or Makefile recipes.
+|===
+
+[[schema]]
+== Schema — manifests & contracts
+
+Validate structured manifests and executable contract declarations.
+
+link:catalogue/clades/schema.adoc[Explore this clade — 2 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/manifest-check/action.yml[DEED & K9 manifests] |validator |enforcing |Use maintained format validators for manifest structure.
+|link:actions/contractile-validation-check/action.yml[Contractile declarations] |validator |tool-dependent |Validate applicable DEED contract declarations with maintained tooling.
+|===
+
+[[proof]]
+== Proof — languages & verification
+
+Compile, test, inspect interfaces and execute proof tools where applicable.
+
+link:catalogue/clades/proof.adoc[Explore this clade — 7 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/rust-ci-check/action.yml[Strict Rust CI] |build-test |enforcing |Locked check, formatting, clippy, tests, doctests, documentation and MSRV phases.
+|link:actions/creusot-check/action.yml[Rust deductive verification] |proof-executor |enforcing |Inspect verification claims, run planted controls and execute Creusot obligations.
+|link:actions/spark-check/action.yml[Ada/SPARK proof] |proof-executor |enforcing |Inspect SPARK projects, run planted controls and execute GNATprove.
+|link:actions/kanren-check/action.yml[Relational-code checks] |build-test |enforcing |Detect relations, require goal-level tests and run applicable relational tests.
+|link:actions/proof-runner-check/action.yml[Idris2 & Lean proof runner] |proof-executor |tool-dependent |Run applicable Idris2 project typechecks and Lean lake builds.
+|link:actions/idris2-abi-check/action.yml[Idris2 ABI source policy] |policy-gate |enforcing |When abi.ipkg exists, scan selected ABI source paths for prohibited IO/unsafe patterns.
+|link:actions/zig-unified-api-adapter-check/action.yml[Zig adapter source policy] |policy-gate |enforcing |Scan Zig files for direct std.fs/std.io usage prohibited by estate adapter policy.
+|===
+
+[[bridge]]
+== Bridge — ecosystem integration
+
+Connect BoJ capabilities and external analysis tools to repository checks.
+
+link:catalogue/clades/bridge.adoc[Explore this clade — 2 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/boj-cartridge-check/action.yml[BoJ cartridge applicability] |integration |enforcing |Check cartridge presence when BoJ integration applies or is declared required.
+|link:actions/custom-tools-check/action.yml[Pons & Panic Attack] |integration |tool-dependent |Execute pons scan and panic-attack assail with explicit unavailable-tool outcomes.
+|===
+
+[[observatory]]
+== Observatory — advisory signals
+
+Discover useful signals without presenting warnings or heuristics as certification.
+
+link:catalogue/clades/observatory.adoc[Explore this clade — 7 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/badges-check/action.yml[Accreditations & badges] |advisory |advisory |Inspect badge/accreditation conventions and report advisory signals.
+|link:actions/gitsea-check/action.yml[Analytics declarations] |advisory |advisory |Inspect Git-Sea analytics configuration and disclaimer conventions.
+|link:actions/hosting-check/action.yml[Hosting configuration] |advisory |advisory |Identify hosting targets from repository configuration.
+|link:actions/metrics-check/action.yml[Metrics & proof indicators] |advisory |advisory |Extract log/source heuristics for an advisory metrics view.
+|link:actions/tests-benches-check/action.yml[Test & benchmark discoverability] |advisory |advisory |Look for benchmark mentions and test/benchmark dashboards.
+|link:actions/trust-humans-check/action.yml[Human trust declarations] |advisory |advisory |Inspect trust.txt/humans.txt and association conventions.
+|link:actions/www-compliance-check/action.yml[Web & well-known conventions] |advisory |advisory |Inspect website and well-known/resource conventions.
+|===
+
+[[frontier]]
+== Frontier — unfinished capabilities
+
+Visible roadmap boundaries: not implemented assurance and not recommended gates.
+
+link:catalogue/clades/frontier.adoc[Explore this clade — 2 capabilities]
+
+[cols="2,2,2,5",options="header"]
+|===
+|Capability |Nature |Status |What it does
+|link:actions/prat-check/action.yml[PRAT testing placeholder] |placeholder |stub |Heuristic presence/mention detection for prospective property-testing integration.
+|link:actions/semantic-audit-check/action.yml[Semantic audit placeholder] |placeholder |stub |Reserved integration point for future semantic analysis.
+|===
+
+== Adopt deliberately
+
+Start with a reusable workflow/caller template where supplied: it handles orchestration that a bare composite may not. Read the action's inputs, scripts, prerequisites and test controls. Pin an already-published, tested source SHA; update the caller lock and complete dependency closure together. Never turn unavailable tools, absent analysis or skipped work into a green assurance claim.
+
+* link:templates/estate-audit-caller.yml[Estate-audit caller]
+* link:.github/workflows/main-estate-audit.yml[Estate-audit orchestration]
+* link:docs/SECRET-SCANNER-ROLLOUT.adoc[Secret-scanner rollout and security boundaries]
+* link:docs/GOVERNANCE-AND-SONAR-REPAIR.adoc[Governance and Sonar verification guidance]
+* link:README.adoc[Operational README, known defects and test guidance]
+
+== Keep the atlas honest
+
+The single inventory is link:catalogue/capabilities.json[catalogue/capabilities.json]. Every action must appear exactly once in one primary clade; status and nature remain independent. Adding an action without cataloguing it, breaking a target link, duplicating an entry or leaving generated pages stale fails the catalogue checks.
+
+[source,shell]
+----
+bash scripts/build-capability-catalogue.sh
+bash scripts/build-capability-catalogue.sh --check
+bash tests/capability-catalogue.sh
+----