aiwg 2026.8.26 → 2026.8.28

package/agentic/code/extensions/dev/ADDON.yaml

@@ -9,3 +9,6 @@ spec:
   description: "DevOps — CI/CD pipelines, build automation, fleet-wide tooling"
   version: "1.0.0"
   capabilities: auto-discover
+  kinds:
+    - name: DevBuildPlaybook
+      schema: schemas/dev-artifacts.schema.json

package/agentic/code/extensions/dev/schemas/dev-artifacts.schema.json

@@ -0,0 +1,26 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/ops/dev/v1/dev-artifacts.schema.json",
+  "title": "Dev operations extension artifacts",
+  "type": "object",
+  "required": ["apiVersion", "kind", "metadata", "spec"],
+  "additionalProperties": false,
+  "properties": {
+    "apiVersion": { "const": "dev.ops.aiwg.io/v1" },
+    "kind": { "enum": ["DevBuildPlaybook"] },
+    "metadata": { "$ref": "#/definitions/metadata" },
+    "spec": { "type": "object", "additionalProperties": true }
+  },
+  "definitions": {
+    "metadata": {
+      "type": "object",
+      "required": ["name"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "namespace": { "type": "string" },
+        "labels": { "type": "object", "additionalProperties": { "type": "string" } }
+      }
+    }
+  }
+}

package/agentic/code/extensions/dev/templates/build-playbook.yaml

@@ -1,5 +1,5 @@
-apiVersion: ops.aiwg.io/v1
-kind: OpsPlaybook
+apiVersion: dev.ops.aiwg.io/v1
+kind: DevBuildPlaybook
 metadata:
   name: "{builder-name}-build"
   labels:

package/agentic/code/extensions/it/ADDON.yaml

@@ -9,3 +9,10 @@ spec:
   description: "IT operations — asset management, CMDB, service deployments, disaster recovery"
   version: "1.0.0"
   capabilities: auto-discover
+  kinds:
+    - name: ITAsset
+      schema: schemas/it-asset.schema.json
+    - name: ITService
+      schema: schemas/it-service.schema.json
+    - name: ITNetworkState
+      schema: schemas/it-network-state.schema.json

package/agentic/code/extensions/it/rules/it-asset-authority.md

@@ -24,7 +24,7 @@ The Configuration Management Database (CMDB) is the authoritative source of trut
    - Revoke identity provider credentials and certificates
    - Remove DNS records
    - Update dependent service documentation
-   - Archive the asset record (set status to `retired`, do not delete)
+   - Archive the minimum durable asset record (set status to `retired`; dispose of expired sensitive fields under its lifecycle policy)
    - Record decommission date and reason
 
 4. **Status transitions must be documented**: Changing an asset's status (active to maintenance, active to retired) requires a change record. Status changes must include a reason and be traceable to an issue.
@@ -33,6 +33,10 @@ The Configuration Management Database (CMDB) is the authoritative source of trut
 
 6. **Asset records must be complete**: An asset record missing critical fields (hostname, IP, owner, SLA tier) is considered incomplete. Incomplete records must be flagged for remediation.
 
+7. **Authority does not mean indefinite retention**: Preserve the authoritative identity/status/history needed for CMDB traceability, while lifecycle policy may summarize, redact, archive, or dispose of expired sensitive fields and generated reconciliation evidence. A legal/compliance hold pauses disposition explicitly; it does not silently rewrite the policy.
+
+8. **Publication is gated**: Asset records default to `restricted-infrastructure`. Every repository, issue/PR/comment, cross-repo, or export sink must pass the ops information-governance boundary before disclosure.
+
 ## Validation
 
 When working with asset records:

package/agentic/code/extensions/it/schemas/it-asset.schema.json

@@ -0,0 +1,93 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/ops/it/v1/it-asset.schema.json",
+  "title": "ITAsset",
+  "type": "object",
+  "required": ["apiVersion", "kind", "metadata", "spec"],
+  "additionalProperties": false,
+  "properties": {
+    "apiVersion": { "const": "it.ops.aiwg.io/v1" },
+    "kind": { "const": "ITAsset" },
+    "metadata": { "$ref": "#/definitions/metadata" },
+    "spec": {
+      "type": "object",
+      "required": ["asset", "owner", "location", "lifecycle", "sla", "network", "tags"],
+      "additionalProperties": false,
+      "properties": {
+        "asset": { "$ref": "#/definitions/stringMap" },
+        "owner": { "type": "string" },
+        "location": { "$ref": "#/definitions/stringMap" },
+        "lifecycle": {
+          "type": "object",
+          "required": ["provisioned", "last_maintained", "decommission_date"],
+          "additionalProperties": false,
+          "properties": {
+            "provisioned": { "type": "string" },
+            "last_maintained": { "type": "string" },
+            "decommission_date": { "type": ["string", "null"] }
+          }
+        },
+        "sla": { "$ref": "#/definitions/stringMap" },
+        "network": { "$ref": "#/definitions/stringMap" },
+        "tags": { "type": "array", "items": { "type": "string" } },
+        "notes": { "type": "string" }
+      }
+    }
+  },
+  "definitions": {
+    "metadata": {
+      "type": "object",
+      "required": ["name", "governance", "lifecycle"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "namespace": { "type": "string" },
+        "labels": { "type": "object", "additionalProperties": { "type": "string" } },
+        "governance": { "$ref": "#/definitions/governance" },
+        "lifecycle": { "$ref": "#/definitions/lifecycle" }
+      }
+    },
+    "governance": {
+      "type": "object",
+      "required": ["classification", "owner", "handling"],
+      "additionalProperties": false,
+      "properties": {
+        "classification": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "owner": { "type": "string", "minLength": 1 },
+        "handling": {
+          "type": "object",
+          "required": ["allowedSinks", "crossRepo", "retentionPolicy"],
+          "additionalProperties": false,
+          "properties": {
+            "allowedSinks": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" } },
+            "crossRepo": { "enum": ["allow", "approval-required", "deny"] },
+            "retentionPolicy": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" }
+          }
+        }
+      }
+    },
+    "lifecycle": {
+      "type": "object",
+      "required": ["schemaVersion", "artifactId", "category", "classification", "sinkId", "tier", "createdAt", "policyId", "policyVersion", "dispositionDeadline", "action", "holds"],
+      "additionalProperties": false,
+      "properties": {
+        "schemaVersion": { "const": "ops-evidence-lifecycle.aiwg.io/v1" },
+        "artifactId": { "type": "string", "minLength": 1 },
+        "category": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "classification": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "sinkId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "tier": { "enum": ["raw", "durable"] },
+        "createdAt": { "type": "string" },
+        "policyId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "policyVersion": { "type": "string" },
+        "dispositionDeadline": { "type": ["string", "null"] },
+        "action": { "enum": ["retain", "summarize", "redact-fields", "archive", "delete"] },
+        "rawCaptureReasonDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "dispositionFields": { "type": "array", "items": { "type": "string" } },
+        "archiveSink": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "holds": { "type": "array", "items": { "type": "object" } }
+      }
+    },
+    "stringMap": { "type": "object", "additionalProperties": { "type": "string" } }
+  }
+}

package/agentic/code/extensions/it/schemas/it-network-state.schema.json

@@ -0,0 +1,108 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/ops/it/v1/it-network-state.schema.json",
+  "title": "ITNetworkState",
+  "type": "object",
+  "required": ["apiVersion", "kind", "metadata", "spec"],
+  "additionalProperties": false,
+  "properties": {
+    "apiVersion": { "const": "it.ops.aiwg.io/v1" },
+    "kind": { "const": "ITNetworkState" },
+    "metadata": { "$ref": "#/definitions/metadata" },
+    "spec": {
+      "type": "object",
+      "required": ["vlans", "dns_zones", "firewall_rules", "switches", "dhcp"],
+      "additionalProperties": false,
+      "properties": {
+        "vlans": { "type": "array", "items": { "$ref": "#/definitions/stringMap" } },
+        "dns_zones": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["zone", "type", "server", "records"],
+            "additionalProperties": false,
+            "properties": {
+              "zone": { "type": "string" },
+              "type": { "type": "string" },
+              "server": { "type": "string" },
+              "records": { "type": "array", "items": { "$ref": "#/definitions/stringMap" } }
+            }
+          }
+        },
+        "firewall_rules": { "type": "array", "items": { "$ref": "#/definitions/stringMap" } },
+        "switches": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "required": ["name", "model", "management_ip", "ports", "uplinks"],
+            "additionalProperties": false,
+            "properties": {
+              "name": { "type": "string" },
+              "model": { "type": "string" },
+              "management_ip": { "type": "string" },
+              "ports": { "type": "string" },
+              "uplinks": { "type": "array", "items": { "type": "string" } }
+            }
+          }
+        },
+        "dhcp": { "type": "array", "items": { "$ref": "#/definitions/stringMap" } }
+      }
+    }
+  },
+  "definitions": {
+    "metadata": {
+      "type": "object",
+      "required": ["name", "governance", "lifecycle"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "namespace": { "type": "string" },
+        "labels": { "type": "object", "additionalProperties": { "type": "string" } },
+        "governance": { "$ref": "#/definitions/governance" },
+        "lifecycle": { "$ref": "#/definitions/lifecycle" }
+      }
+    },
+    "governance": {
+      "type": "object",
+      "required": ["classification", "owner", "handling"],
+      "additionalProperties": false,
+      "properties": {
+        "classification": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "owner": { "type": "string", "minLength": 1 },
+        "handling": {
+          "type": "object",
+          "required": ["allowedSinks", "crossRepo", "retentionPolicy"],
+          "additionalProperties": false,
+          "properties": {
+            "allowedSinks": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" } },
+            "crossRepo": { "enum": ["allow", "approval-required", "deny"] },
+            "retentionPolicy": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" }
+          }
+        }
+      }
+    },
+    "lifecycle": {
+      "type": "object",
+      "required": ["schemaVersion", "artifactId", "category", "classification", "sinkId", "tier", "createdAt", "policyId", "policyVersion", "dispositionDeadline", "action", "holds"],
+      "additionalProperties": false,
+      "properties": {
+        "schemaVersion": { "const": "ops-evidence-lifecycle.aiwg.io/v1" },
+        "artifactId": { "type": "string", "minLength": 1 },
+        "category": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "classification": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "sinkId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "tier": { "enum": ["raw", "durable"] },
+        "createdAt": { "type": "string" },
+        "policyId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "policyVersion": { "type": "string" },
+        "dispositionDeadline": { "type": ["string", "null"] },
+        "action": { "enum": ["retain", "summarize", "redact-fields", "archive", "delete"] },
+        "rawCaptureReasonDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "dispositionFields": { "type": "array", "items": { "type": "string" } },
+        "archiveSink": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "holds": { "type": "array", "items": { "type": "object" } }
+      }
+    },
+    "stringMap": { "type": "object", "additionalProperties": { "type": "string" } }
+  }
+}

package/agentic/code/extensions/it/schemas/it-service.schema.json

@@ -0,0 +1,103 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "$id": "https://aiwg.io/schemas/ops/it/v1/it-service.schema.json",
+  "title": "ITService",
+  "type": "object",
+  "required": ["apiVersion", "kind", "metadata", "spec"],
+  "additionalProperties": false,
+  "properties": {
+    "apiVersion": { "const": "it.ops.aiwg.io/v1" },
+    "kind": { "const": "ITService" },
+    "metadata": { "$ref": "#/definitions/metadata" },
+    "spec": {
+      "type": "object",
+      "required": ["deployment", "health", "dependencies", "backup", "monitoring", "owner", "sla"],
+      "additionalProperties": false,
+      "properties": {
+        "deployment": { "$ref": "#/definitions/stringMap" },
+        "health": { "$ref": "#/definitions/stringMap" },
+        "dependencies": { "type": "array", "items": { "type": "string" } },
+        "backup": {
+          "type": "object",
+          "required": ["enabled", "schedule", "retention", "method", "target"],
+          "additionalProperties": false,
+          "properties": {
+            "enabled": { "type": "boolean" },
+            "schedule": { "type": "string" },
+            "retention": { "type": "string" },
+            "method": { "type": "string" },
+            "target": { "type": "string" }
+          }
+        },
+        "monitoring": {
+          "type": "object",
+          "required": ["dashboard", "alerts"],
+          "additionalProperties": false,
+          "properties": {
+            "dashboard": { "type": "string" },
+            "alerts": { "type": "array", "items": { "type": "string" } }
+          }
+        },
+        "owner": { "type": "string" },
+        "sla": { "$ref": "#/definitions/stringMap" },
+        "notes": { "type": "string" }
+      }
+    }
+  },
+  "definitions": {
+    "metadata": {
+      "type": "object",
+      "required": ["name", "governance", "lifecycle"],
+      "additionalProperties": false,
+      "properties": {
+        "name": { "type": "string" },
+        "namespace": { "type": "string" },
+        "labels": { "type": "object", "additionalProperties": { "type": "string" } },
+        "governance": { "$ref": "#/definitions/governance" },
+        "lifecycle": { "$ref": "#/definitions/lifecycle" }
+      }
+    },
+    "governance": {
+      "type": "object",
+      "required": ["classification", "owner", "handling"],
+      "additionalProperties": false,
+      "properties": {
+        "classification": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "owner": { "type": "string", "minLength": 1 },
+        "handling": {
+          "type": "object",
+          "required": ["allowedSinks", "crossRepo", "retentionPolicy"],
+          "additionalProperties": false,
+          "properties": {
+            "allowedSinks": { "type": "array", "minItems": 1, "uniqueItems": true, "items": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" } },
+            "crossRepo": { "enum": ["allow", "approval-required", "deny"] },
+            "retentionPolicy": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" }
+          }
+        }
+      }
+    },
+    "lifecycle": {
+      "type": "object",
+      "required": ["schemaVersion", "artifactId", "category", "classification", "sinkId", "tier", "createdAt", "policyId", "policyVersion", "dispositionDeadline", "action", "holds"],
+      "additionalProperties": false,
+      "properties": {
+        "schemaVersion": { "const": "ops-evidence-lifecycle.aiwg.io/v1" },
+        "artifactId": { "type": "string", "minLength": 1 },
+        "category": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "classification": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "sinkId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "tier": { "enum": ["raw", "durable"] },
+        "createdAt": { "type": "string" },
+        "policyId": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "policyVersion": { "type": "string" },
+        "dispositionDeadline": { "type": ["string", "null"] },
+        "action": { "enum": ["retain", "summarize", "redact-fields", "archive", "delete"] },
+        "rawCaptureReasonDigest": { "type": "string", "pattern": "^sha256:[a-f0-9]{64}$" },
+        "dispositionFields": { "type": "array", "items": { "type": "string" } },
+        "archiveSink": { "type": "string", "pattern": "^[a-z0-9][a-z0-9.-]*$" },
+        "holds": { "type": "array", "items": { "type": "object" } }
+      }
+    },
+    "stringMap": { "type": "object", "additionalProperties": { "type": "string" } }
+  }
+}

package/agentic/code/extensions/it/skills/it-asset-sync.md

@@ -94,3 +94,7 @@ Produce a reconciliation report with:
 - Drift summary (matched, drifted, missing, unreachable counts)
 - Per-asset remediation recommendations
 - List of unregistered hosts requiring CMDB enrollment
+
+## Governance Boundary
+
+Classify live and reconciled asset data as `restricted-infrastructure`. Keep raw discovery output in the short-lived raw tier only when an explicit reason is recorded; the durable reconciliation report defaults to counts, field names, status, bounded redacted excerpts, and record fingerprints. Before writing the CMDB report or posting a discrepancy to an issue, invoke `aiwg ops evidence prepare`. Public/immutable trackers receive only a sanitized summary, never hostnames, addresses, serials, owners, or backup paths.

package/agentic/code/extensions/it/skills/it-dr-test.md

@@ -24,7 +24,7 @@ Execute a disaster recovery runbook in a controlled test environment to validate
 Walk through each step of the DR runbook in the test environment:
 
 - Execute each command as documented
-- Record actual output vs. expected output for each step
+- Record status plus bounded redacted excerpts/digests against expected output for each step
 - Note any steps that require modification
 - Time each major phase
 
@@ -78,3 +78,7 @@ Produce a test report:
 - Updated DR runbook (if corrections needed)
 - Updated test history
 - Issue tickets for unresolved problems
+
+## Governance Boundary
+
+DR artifacts default to `restricted-infrastructure` with the `dr-evidence` retention category. Recovery commands, backup destinations, topology, timings, and raw validation output must pass through `aiwg ops evidence prepare` before persistence. Full raw capture requires an explicit reason and short TTL. Durable reports preserve outcome, RTO/RPO status, bounded redacted excerpts, and digests. Immutable issue sinks receive only a prepared sanitized summary that does not depend on later deletion.

package/agentic/code/extensions/it/skills/it-identity-audit.md

@@ -110,3 +110,7 @@ Produce a consolidated identity audit report with:
 - Certificate expiry timeline
 - Unused client inventory
 - Policy drift assessment
+
+## Governance Boundary
+
+Identity evidence defaults to `restricted-identity`. Durable output is aggregated by finding/status unless a named user is required for an authorized remediation; raw API responses, bearer headers, named-user lists, redirect URIs, and certificate metadata remain short-lived restricted evidence. Invoke `aiwg ops evidence prepare` before every report write or tracker/publication action. Issue and comment sinks receive only non-expiring sanitized counts unless an explicit destination policy and scoped approval authorize more. Redaction and classification audit records must not reproduce usernames, tokens, URLs, or finding payloads.

package/agentic/code/extensions/it/skills/it-network-state.md

@@ -94,3 +94,7 @@ nft add rule inet filter input tcp dport {port} accept
 - Network state comparison report
 - Drift summary (count of matches, drifts, missing items)
 - Optional remediation commands
+
+## Governance Boundary
+
+Network collection and comparison artifacts default to `restricted-infrastructure` with the `network-inventory` retention category. Raw firewall, routing, DNS, and interface output is short-lived and requires an explicit capture reason. Durable reports use minimum sufficient drift counts and redacted bounded excerpts. Invoke `aiwg ops evidence prepare` before a report/artifact write, agent response containing collected state, repository commit, export, or issue/PR/comment. Less-trusted destinations receive only the prepared payload-free summary.

package/agentic/code/extensions/it/templates/asset-record.yaml

@@ -1,10 +1,30 @@
-apiVersion: ops.aiwg.io/v1
-kind: OpsTarget
+apiVersion: it.ops.aiwg.io/v1
+kind: ITAsset
 metadata:
   name: "{asset-id}"
   labels:
     type: "{server|workstation|network|storage}"
     status: "{active|retired|maintenance}"
+  governance:
+    classification: restricted-infrastructure
+    owner: "{platform-operations-team}"
+    handling:
+      allowedSinks: [private-repository, encrypted-artifact-store]
+      crossRepo: approval-required
+      retentionPolicy: generic-durable
+  lifecycle:
+    schemaVersion: ops-evidence-lifecycle.aiwg.io/v1
+    artifactId: "{asset-id}"
+    category: generic
+    classification: restricted-infrastructure
+    sinkId: private-repository
+    tier: durable
+    createdAt: "{ISO-8601-created-at}"
+    policyId: generic-durable
+    policyVersion: "1"
+    dispositionDeadline: "{ISO-8601-disposition-deadline}"
+    action: summarize
+    holds: []
 spec:
   asset:
     serial_number: "{serial}"

package/agentic/code/extensions/it/templates/network-state.yaml

@@ -1,9 +1,30 @@
-apiVersion: ops.aiwg.io/v1
-kind: OpsInventory
+apiVersion: it.ops.aiwg.io/v1
+kind: ITNetworkState
 metadata:
   name: "{network-name}"
   labels:
     type: network-state
+  governance:
+    classification: restricted-infrastructure
+    owner: "{network-operations-team}"
+    handling:
+      allowedSinks: [private-repository, encrypted-artifact-store]
+      crossRepo: approval-required
+      retentionPolicy: network-inventory-durable
+  lifecycle:
+    schemaVersion: ops-evidence-lifecycle.aiwg.io/v1
+    artifactId: "{network-name}"
+    category: network-inventory
+    classification: restricted-infrastructure
+    sinkId: encrypted-artifact-store
+    tier: durable
+    createdAt: "{ISO-8601-created-at}"
+    policyId: network-inventory-durable
+    policyVersion: "1"
+    dispositionDeadline: "{ISO-8601-disposition-deadline}"
+    action: archive
+    archiveSink: encrypted-artifact-store
+    holds: []
 spec:
   vlans:
     - id: "{vlan-id}"