{ "schema": "kye.implementation_registry.v1", "version": "1.0", "adopted": "2026-05-19", "constitution_ref": "constitution/40-IMPLEMENTATION-CANONICAL.md", "notes": [ "Seed manifest. Identified concepts from the 2026-05-19 audit prompted by 'we need to be 10000% certain there is only one implementation'. This file grows with every concept clarified — but the registry is itself canonical: any merge that adds a NEW reimplementation of a registered concept fails CI.", "2026-05-21 full runtime drift audit: registry extended from 19 to 46 concepts. Triggered by the prior third-party search SaaS→KYE Native Search Engine drift that CI missed because search/directory were unregistered. Competing-systems smells (gateway-worker consolidation, kye-reporting-worker vs kye-reporting-agent-worker, dead private/runtime/search/) are tracked for the runtime-consolidation PR.", "2026-05-23 framework-coverage bidirectional mapping: each concept MAY carry an optional `framework_coverage[]` array of requirement_ids (matching private/specs/compliance//*.json). Verified by scripts/gates/framework-coverage-bijection.mjs. The companion framework-requirement registry (private/specs/compliance//) provides the OUTBOUND map; framework_coverage[] here provides the INBOUND map. Bijection enforced at CI." ], "concepts": [ { "concept_id": "agent-dev-kit", "name": "KYE Agent Dev Kit (TS + Python — agent SDK + lifecycle hooks)", "plane": "runtime", "constitution_ref": "constitution/32-AGENT-DEV-KIT.md", "ssot_module": "private/runtime/agent-dev-kit", "ssot_package": "@kye/agent-dev-kit", "ssot_entry_point": "lifecycle hooks + evidence helpers", "transport_wrappers": [ { "module": "private/runtime/agent-dev-kit-python", "transport": "language-port", "note": "Python port (kye-agent-dev-kit) — same contract, separate language; parallel SSOT per §32." } ], "competitor_forbidden_patterns": [ "function makePurposeAdmissibility(", "const makePurposeAdmissibility =", "class makePurposeAdmissibility " ] }, { "concept_id": "agent.demo", "name": "Demo Agent — SSOT library", "plane": "onboarding", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/demo-agent", "ssot_package": "@kye/demo-agent", "ssot_entry_point": "DemoAgent", "transport_wrappers": [ { "module": "private/runtime/kye-demo-agent", "transport": "http", "note": "CF Worker — agent_manifest runtime_path for the Demo Agent; imports the SSOT via ../../demo-agent/src/index.js." } ], "competitor_forbidden_patterns": [ "function CANONICAL_DEMO_SCENARIOS(", "const CANONICAL_DEMO_SCENARIOS =", "class CANONICAL_DEMO_SCENARIOS " ] }, { "concept_id": "agent.dsar-evidence", "name": "DSAR Evidence Agent — SSOT library", "plane": "evidence", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/dsar-evidence-agent", "ssot_package": "@kye/dsar-evidence-agent", "ssot_entry_point": "DsarEvidenceAgent", "transport_wrappers": [ { "module": "private/runtime/kye-dsar-evidence-agent", "transport": "http", "note": "CF Worker — agent_manifest runtime_path for the DSAR Evidence Agent; imports the SSOT via ../../dsar-evidence-agent/src/index.js." } ], "competitor_forbidden_patterns": [ "function assembleEvidenceRows(", "const assembleEvidenceRows =", "class assembleEvidenceRows " ] }, { "concept_id": "agent.entitlements", "name": "Entitlements Agent — SSOT library", "plane": "billing", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/entitlements-agent", "ssot_package": "@kye/entitlements-agent", "ssot_entry_point": "EntitlementsAgent", "transport_wrappers": [ { "module": "private/runtime/kye-entitlements-agent", "transport": "http", "note": "CF Worker — agent_manifest runtime_path for the Entitlements Agent; imports the SSOT via ../../entitlements-agent/src/index.js." } ], "competitor_forbidden_patterns": [ "function EntitlementsAgent(", "const EntitlementsAgent =", "class EntitlementsAgent " ] }, { "concept_id": "agent.ops", "name": "Ops Agent — SSOT library", "plane": "runtime", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/ops-agent", "ssot_package": "@kye/ops-agent", "ssot_entry_point": "OpsAgent", "transport_wrappers": [ { "module": "private/runtime/kye-ops-agent", "transport": "http", "note": "CF Worker — agent_manifest runtime_path for the Ops Agent; imports the SSOT via ../../ops-agent/src/index.js." } ], "competitor_forbidden_patterns": [ "function disabledCapabilityIds(", "const disabledCapabilityIds =", "class disabledCapabilityIds " ] }, { "concept_id": "agent.silent-compromise", "name": "Silent Compromise Agent — SSOT library", "plane": "governance", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/silent-compromise-agent", "ssot_package": "@kye/silent-compromise-agent", "ssot_entry_point": "SilentCompromiseAgent", "transport_wrappers": [ { "module": "private/runtime/kye-silent-compromise-agent", "transport": "http", "note": "CF Worker — agent_manifest runtime_path for the Silent Compromise Agent; imports the SSOT via ../../silent-compromise-agent/src/index.js." } ], "competitor_forbidden_patterns": [ "function SilentCompromiseAgent(", "const SilentCompromiseAgent =", "class SilentCompromiseAgent " ] }, { "concept_id": "agent.sku-lifecycle", "name": "SKU Lifecycle Agent — SSOT library", "plane": "billing", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/sku-lifecycle-agent", "ssot_package": "@kye/sku-lifecycle-agent", "ssot_entry_point": "SkuLifecycleAgent", "transport_wrappers": [ { "module": "private/runtime/kye-sku-lifecycle-agent", "transport": "http", "note": "CF Worker — agent_manifest runtime_path for the SKU Lifecycle Agent; imports the SSOT via ../../sku-lifecycle-agent/src/index.js." } ], "competitor_forbidden_patterns": [ "function SkuLifecycleAgent(", "const SkuLifecycleAgent =", "class SkuLifecycleAgent " ] }, { "concept_id": "agent.trainer", "name": "Trainer Agent — SSOT library", "plane": "runtime", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/trainer-agent", "ssot_package": "@kye/trainer-agent", "ssot_entry_point": "TrainerAgent", "transport_wrappers": [ { "module": "private/runtime/kye-trainer-agent", "transport": "http", "note": "CF Worker — agent_manifest runtime_path for the Trainer Agent; imports the SSOT via ../../trainer-agent/src/index.js." } ], "competitor_forbidden_patterns": [ "function TrainerAgent(", "const TrainerAgent =", "class TrainerAgent " ] }, { "concept_id": "analytics.clickhouse-client", "name": "Analytics Plane HTTP client for ClickHouse (Worker-compatible)", "plane": "runtime", "constitution_ref": "constitution/20-ANALYTICS-PLANE.md", "ssot_module": "private/runtime/clickhouse-client", "ssot_package": "@kye/clickhouse-client", "ssot_entry_point": "tenant-token-scoped ClickHouse HTTP client (tables / projections / queries / audit-emit)", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function assertTemplateIsTenantSafe(", "const assertTemplateIsTenantSafe =", "class assertTemplateIsTenantSafe " ] }, { "concept_id": "audit.chain.append", "name": "Audit chain append + the chain id it appends to (§0.3 evidence emission)", "plane": "audit", "constitution_ref": "constitution/21-DELEGATED-AUDITABILITY.md", "ssot_module": "private/runtime/audit-chain", "ssot_package": null, "ssot_entry_point": "appendEvent(envelope) · workerChainEmitter(baseUrl) · tenantChainId(tenant_id) / platformChainId(component)", "transport_wrappers": [ { "module": "private/runtime/audit-chain-worker", "transport": "http", "note": "HTTP surface; receives the append from every privileged Worker. It is the RECEIVER, so it legitimately owns CHAIN_ID_RE and the /v1/chains/:chain_id/{append,verify} route patterns — a validator has to spell out what it validates. Declared so the enforcer does not accuse the one module whose job is to hold the shape." }, { "module": "private/lib/chain-id", "transport": "library", "note": "The tenant→chain-id derivation. private/lib/chain-id is the SSOT (plain JS so BOTH the TypeScript emitter can import it and the public plane can receive it by byte-projection across §33); the public/site/functions copy is that projection, verified byte-for-byte by this gate." }, { "module": "public/site/functions/api/_lib/chain-id.js", "transport": "projection", "note": "Byte-projection of private/lib/chain-id for the Pages Functions, which cannot import a private/ module across §33. Three of them wrote `kye:audit-chain:${tenantId}` inline with no strip — accepted by the receiver, but a DIFFERENT chain from the stripped form, so a tenant's audit history split in two." } ], "competitor_forbidden_patterns": [ "function InProcessAuditEmitter(", "const InProcessAuditEmitter =", "class InProcessAuditEmitter ", "`kye:audit-chain:${", "function canonicalEmit(", "function chainIdForTenant(" ], "competitor_baseline_key": "implementation_canonical__competitors__audit_chain_append", "migration": { "status": "complete", "tracked_in": "private/specs/ratchets/baselines.json#implementation_canonical__competitors__audit_chain_append" } }, { "concept_id": "audit.replay-run", "name": "Audit replay orchestration (re-derive evidence packs on a cadence + emit drift)", "plane": "audit", "constitution_ref": "constitution/21-DELEGATED-AUDITABILITY.md", "ssot_module": "private/runtime/audit-replay-orchestrator", "ssot_package": null, "ssot_entry_point": "scheduled() — worker.js", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function AuditReplayOrchestrator(", "const AuditReplayOrchestrator =", "class AuditReplayOrchestrator " ] }, { "concept_id": "authority.grant", "name": "Authority Engine (issue/revoke/validate Authority Grants + delegation walk)", "plane": "decision", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/authority-engine", "ssot_package": "@kye/authority-engine", "ssot_entry_point": "grant / revoke / validate + cascade", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function verifyGrantViaCustody(", "const verifyGrantViaCustody =", "class verifyGrantViaCustody " ] }, { "concept_id": "authority.proof-bundle.assemble", "name": "Authority Proof Bundle assembler", "plane": "evidence", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/authority-proof-bundle", "ssot_package": null, "ssot_entry_point": "assembleBundle(...)", "transport_wrappers": [ { "module": "private/runtime/authority-proof-bundle-worker", "transport": "http", "note": "HTTP surface that wraps the assembler" } ], "competitor_forbidden_patterns": [ "function assembleBundle(", "const assembleBundle =", "class assembleBundle " ] }, { "concept_id": "billing.metering", "name": "Stripe billing/metering client (BPS calc + meter batcher + webhook verify)", "plane": "billing", "constitution_ref": "constitution/23-BILLING-METERING.md", "ssot_module": "private/runtime/stripe-client", "ssot_package": "@kye/stripe-client", "ssot_entry_point": "typed Stripe wrapper + meter batcher", "transport_wrappers": [ { "module": "private/runtime/stripe-meter", "transport": "cron", "note": "Hourly Stripe meter Worker (§23)" } ], "competitor_forbidden_patterns": [ "function BPS_APPLICABLE_ACTION_CLASSES(", "const BPS_APPLICABLE_ACTION_CLASSES =", "class BPS_APPLICABLE_ACTION_CLASSES " ] }, { "concept_id": "ci.privileged_op_evidence", "name": "Emit the §0.3 evidence family for a privileged CI action", "plane": "evidence", "constitution_ref": "constitution/00-INDEX.md", "ssot_module": "scripts/ci/govern-privileged-op.mjs", "ssot_package": null, "ssot_entry_point": "node scripts/ci/govern-privileged-op.mjs (env: GOP_CAPABILITY, GOP_PURPOSE, GOP_ALLOWED_EVENTS)", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function emitEvidencePack(", "const emitEvidencePack =" ], "competitor_baseline_key": "implementation_canonical__competitors__ci_privileged_op_evidence", "migration": { "status": "complete", "note": "Registered 2026-08-15. Invoked BOTH via the .github/actions/govern-op composite AND directly by workflows such as deploy-cloudflare-pages.yml. An agent grepping only the composite name reported KYE's public landing deploy as ungoverned — a false finding caused by matching the wrapper instead of the mechanism." } }, { "concept_id": "ci.workflow_privileged_classification", "name": "Is a CI workflow privileged, and at what tier?", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md", "ssot_module": "scripts/lib/workflow-classification.mjs", "ssot_package": null, "ssot_entry_point": "classifyWorkflow({ slug, text, triggers }) -> { kind, risk_tier, privileged_ops, classification_basis }", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function classifyWorkflow(", "const classifyWorkflow =" ], "competitor_baseline_key": "implementation_canonical__competitors__ci_workflow_privileged_classification", "migration": { "status": "complete", "note": "Registered 2026-08-15 after an agent hand-rolled a secrets+mutation grep as a THIRD copy of this question. The module's own header already warned: workflow-governance-coverage asks 'is this privileged, and is it governed?' and build-workflow-registry asks 'is this privileged, so what tier?' — same question, one answer. Its HONEST LIMIT is load-bearing: 'mutating' means the canonical privileged-op set, and widening that set is a §0.3 amendment, not a tweak. A grep that widens it silently produces false gaps." } }, { "concept_id": "ckan.connector", "name": "CKAN Connector (read-only CKAN Action API client → canonical KYE entities)", "plane": "connector", "constitution_ref": "constitution/28-CKAN-OPEN-DATA.md", "ssot_module": "private/runtime/ckan-connector", "ssot_package": "@kye/ckan-connector", "ssot_entry_point": "pull portal/datasets/activity → map to KYE entities", "transport_wrappers": [ { "module": "private/runtime/ckan-connector-worker", "transport": "cron", "note": "Cron-triggered harvester Worker" } ], "competitor_forbidden_patterns": [ "function mapPortalStatus(", "const mapPortalStatus =", "class mapPortalStatus " ] }, { "concept_id": "commercial.lifecycle", "name": "Commercial Lifecycle Agent (16-state commercial workflow machine)", "plane": "billing", "constitution_ref": "constitution/27-COMMERCIAL-LIFECYCLE.md", "ssot_module": "private/runtime/commercial-lifecycle-agent", "ssot_package": "@kye/commercial-lifecycle-agent", "ssot_entry_point": "lifecycle-machine.json runner", "transport_wrappers": [ { "module": "private/runtime/commercial-lifecycle-worker", "transport": "queue", "note": "KYE_LIFECYCLE_QUEUE consumer Worker" } ], "competitor_forbidden_patterns": [ "function CommercialLifecycleRunner(", "const CommercialLifecycleRunner =", "class CommercialLifecycleRunner " ] }, { "concept_id": "comms.delivery.email", "name": "Email delivery primitive (CF Email Sending binding)", "plane": "comms", "constitution_ref": "constitution/38-COMMS-RAIL.md", "ssot_module": "private/runtime/mail-sender", "ssot_package": null, "ssot_entry_point": "POST /send", "transport_wrappers": [ { "module": "private/runtime/kye-comms-engine-worker", "transport": "service-binding", "note": "Comms Engine routes compiled templates through mail-sender via the MAIL_SENDER service binding" } ], "competitor_scan_exemption": { "reason": "Delivery is a deployed worker reached over a transport; a competing sender is a second deployed surface, which the delivery gate reconciles and a symbol pattern cannot.", "enforced_by": "email-delivery-canonical" } }, { "concept_id": "comms.dispatch", "name": "Outbound communications dispatch", "plane": "comms", "constitution_ref": "constitution/38-COMMS-RAIL.md", "ssot_module": "private/runtime/kye-comms-engine-worker", "ssot_package": null, "ssot_entry_point": "POST /v1/comms/dispatch", "transport_wrappers": [ { "module": "public/site/functions/api/_lib/comms-dispatch.js", "transport": "http-client", "note": "Pages Functions client (kye-protocol Pages project)" }, { "module": "public/admin/functions/api/_lib/comms-dispatch.js", "transport": "http-client", "note": "Pages Functions client (kye-admin Pages project)" }, { "module": "public/status/functions/api/_lib/comms-dispatch.js", "transport": "http-client", "note": "Pages Functions client (status Pages project)" } ], "competitor_forbidden_patterns": [ "function compileTemplate(", "const compileTemplate =", "class compileTemplate " ] }, { "concept_id": "comms.email-templates", "name": "Outbound email template manifest", "plane": "comms", "constitution_ref": "constitution/38-COMMS-RAIL.md", "ssot_module": "private/specs/comms", "ssot_package": null, "ssot_entry_point": "manifest.json + blocks.json + links.json + providers.json", "transport_wrappers": [], "competitor_scan_exemption": { "reason": "Templates are data files under private/specs/comms; a duplicate is a second template record, not a second exported function.", "enforced_by": "comms-manifest-alive" } }, { "concept_id": "conformance.run", "name": "Conformance Runner (Conformance Pack execution against tenant stacks)", "plane": "governance", "constitution_ref": "constitution/15-MCP-AND-SDK.md", "ssot_module": "private/runtime/conformance-runner", "ssot_package": "@kye/conformance-runner", "ssot_entry_point": "consumeBatch + processMessage", "transport_wrappers": [ { "module": "private/runtime/kye-conformance-runner", "transport": "queue", "note": "Worker shell — wires consumeBatch to the kye-conformance queue" }, { "module": "private/runtime/kye-conformance-scheduler-worker", "transport": "cron", "note": "Periodic re-run scheduler" } ], "competitor_forbidden_patterns": [ "function canonicalComposite(", "const canonicalComposite =", "class canonicalComposite " ] }, { "concept_id": "connector.onboarding-agent", "name": "Connector Onboarding Agent", "plane": "onboarding", "constitution_ref": "constitution/22-ONBOARDING.md", "ssot_module": "private/runtime/connector-onboarding-agent", "ssot_package": null, "ssot_entry_point": "runDiscovery(...)", "transport_wrappers": [ { "module": "private/runtime/connector-onboarding-agent-worker", "transport": "http", "note": "CF Worker HTTP surface" } ], "competitor_forbidden_patterns": [ "function InMemoryConnectorWorkflowStore(", "const InMemoryConnectorWorkflowStore =", "class InMemoryConnectorWorkflowStore " ] }, { "concept_id": "constitution.read", "name": "Constitution + manifests + gates → structured snapshot (the Constitution Engine)", "plane": "governance", "constitution_ref": "constitution/40-IMPLEMENTATION-CANONICAL.md", "ssot_module": "private/runtime/constitution-engine", "ssot_package": "@kye/constitution-engine", "ssot_entry_point": "snapshotConstitution(repoRoot) + checkCompliance(snapshot)", "transport_wrappers": [ { "module": "private/runtime/kye-constitution-gateway-worker", "transport": "http", "must_import": "@kye/constitution-engine", "note": "HTTP surface at constitution.kyeprotocol.com — builds the snapshot at deploy time and serves it as JSON" } ], "competitor_forbidden_patterns": [ "function readImplementationRegistry(", "const readImplementationRegistry =", "class readImplementationRegistry " ] }, { "concept_id": "crypto.byok", "name": "BYOK envelope encryption (tenant-managed CMK for R2 Evidence Packs + D1 audit logs)", "plane": "runtime", "constitution_ref": "constitution/30-AUDIT-WORM-RETENTION.md", "ssot_module": "private/runtime/byok", "ssot_package": "@kye/byok", "ssot_entry_point": "RFC 8152 envelope encryption — per-record DEK + customer-KMS-wrapped DEK, re-wrap on KEK rotation", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function InMemoryBYOKConfigStore(", "const InMemoryBYOKConfigStore =", "class InMemoryBYOKConfigStore " ] }, { "concept_id": "crypto.primitives", "name": "Crypto primitives (COSE_Sign1, JWS detached, Evidence Pack / Decision Map signers)", "plane": "runtime", "constitution_ref": "constitution/16-EDGE-RUNTIME.md", "ssot_module": "private/runtime/crypto", "ssot_package": "@kye/crypto", "ssot_entry_point": "COSE/JWS signers (Ed25519)", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function verifyDecisionMapWithPublicJwk(", "const verifyDecisionMapWithPublicJwk =", "class verifyDecisionMapWithPublicJwk " ] }, { "concept_id": "d1.schema", "name": "D1 migration tree (canonical database schema)", "plane": "runtime", "constitution_ref": "constitution/16-EDGE-RUNTIME.md", "ssot_module": "private/runtime/d1", "ssot_package": null, "ssot_entry_point": "d1/migrations/ — ordered migration files", "transport_wrappers": [], "competitor_scan_exemption": { "reason": "The schema is SQL DDL in a migration tree; a competing copy is a second CREATE TABLE, which is a shape no JavaScript symbol pattern can match.", "enforced_by": "d1-schema-apply" } }, { "concept_id": "data.classify", "name": "Data Classification Engine (canonical data classification assign/enforce)", "plane": "decision", "constitution_ref": "constitution/31-DATA-GOVERNANCE-PACK.md", "ssot_module": "private/runtime/data-classification-engine", "ssot_package": "@kye/data-classification-engine", "ssot_entry_point": "classify(asset|payload)", "transport_wrappers": [ { "module": "private/runtime/kye-data-classification-agent", "transport": "http", "note": "HTTP Worker — POST /v1/classifications" } ], "competitor_forbidden_patterns": [ "function DataClassificationEngine(", "const DataClassificationEngine =", "class DataClassificationEngine " ] }, { "concept_id": "decision.pipeline", "name": "Decision Engine (authority + purpose + rules pipeline → Decision Map)", "plane": "decision", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/decision-engine", "ssot_package": "@kye/decision-engine", "ssot_entry_point": "deterministic decision pipeline", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function DECISION_ENGINE_GOVERNANCE_EVENT_FAMILY(", "const DECISION_ENGINE_GOVERNANCE_EVENT_FAMILY =", "class DECISION_ENGINE_GOVERNANCE_EVENT_FAMILY " ] }, { "concept_id": "derived.freshness_verify", "name": "Verify every generator's committed output matches what it would produce", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md", "ssot_module": "scripts/ci/fresh-all.mjs", "ssot_package": null, "ssot_entry_point": "npm run -s test:fresh-all", "transport_wrappers": [], "competitor_forbidden_patterns": [ "const GENERATORS = [" ], "competitor_baseline_key": "implementation_canonical__competitors__derived_freshness_verify", "migration": { "status": "complete", "note": "Registered 2026-08-15. It must never maintain a second generator list — that divergence is what let six derived artefacts drift silently. It is also the authority the build-derived-all reverse-check reads: a generator EXCLUDED from the chain whose output fresh-all verifies must say so in its exclusion reason." } }, { "concept_id": "derived.regeneration", "name": "Regenerate the full derived tree to a fixpoint, in dependency order", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md", "ssot_module": "scripts/build-derived-all.mjs", "ssot_package": null, "ssot_entry_point": "node scripts/build-derived-all.mjs [--check]", "transport_wrappers": [], "competitor_forbidden_patterns": [ "const PHASES = [", "const P1 = [" ], "competitor_baseline_key": "implementation_canonical__competitors__derived_regeneration", "migration": { "status": "complete", "note": "Registered 2026-08-15. Membership and order are DATA in private/specs/propagators/propagator-registry.json; this module is the engine. Both .githooks/pre-commit and .githooks/pre-push invoke it — pre-commit generates and stages, pre-push verifies. Importing it for data EXECUTES it (a full fixpoint run); probe it by spawning, never by import()." } }, { "concept_id": "diagnostic.engine", "name": "Authority Finality Diagnostic — gateway handler", "plane": "diagnostic", "constitution_ref": "constitution/40-IMPLEMENTATION-CANONICAL.md", "ssot_module": "private/runtime/gateway/src/handlers/diagnostic.ts", "ssot_package": null, "ssot_entry_point": "sealDiagnostic / mapDiagnosticFramework / verifyDiagnostic", "endpoints": [ "POST /v1/diagnostic/seal", "POST /v1/diagnostic/framework-map", "POST /v1/diagnostic/verify" ], "transport_wrappers": [ { "module": "private/sdks/typescript/src/client.ts", "transport": "http-client", "note": "client.sealDiagnostic() / client.mapDiagnosticFramework() / client.verifyDiagnostic()" }, { "module": "private/sdks/python/kye_sdk/client.py", "transport": "http-client", "note": "client.diagnostic_seal() / diagnostic_framework_map() / diagnostic_verify()" }, { "module": "private/cli/src/cmds/diagnostic.ts", "transport": "cli", "note": "kye diagnostic seal | framework-map | verify" }, { "module": "public/oss/kye-claude-code-plugin/commands/report.md", "transport": "plugin", "note": "Claude Code /kye:report wraps the seal endpoint" }, { "module": "public/oss/kye-claude-code-plugin/commands/framework-map.md", "transport": "plugin", "note": "Claude Code /kye:framework-map wraps the framework-map endpoint" }, { "module": "public/oss/kye-claude-code-plugin/commands/verify.md", "transport": "plugin", "note": "Claude Code /kye:verify wraps the verify endpoint" }, { "module": "public/oss/kye-mcp-server/src/server.ts", "transport": "mcp", "note": "MCP tools kye_report / kye_framework_map / kye_verify reach every MCP-aware client (Claude Desktop, Claude Code, Cursor, Windsurf, Cline, Zed)" } ], "notes": [ "Production weighting + canonicalisation + palette MAP + Ed25519 signing live in the proprietary diagnostic-engine reached via KYE_DIAGNOSTIC_ENGINE_URL. Smoke-test fallback in the gateway handler uses the published simple-average reference.", "Free-tier quota: 3 sealed envelopes / month / actor_email; enforced via D1 033 sealed_reports + actor_email + month JOIN.", "framework-map reads private/specs/compliance/nist-800-53-rev5-hub.json (canonical) with a fallback to the public mirror at public/site/.well-known/nist-800-53-hub.json; 24-hour in-process cache; no authentication required.", "verify is an online courtesy lookup against the JWKS at https://kyeprotocol.com/.well-known/jwks.json. Full offline Ed25519 verification of canonical bytes is published in the SDK verifier." ], "competitor_forbidden_patterns": [ "function mapDiagnosticFramework(", "const mapDiagnosticFramework =", "class mapDiagnosticFramework " ] }, { "concept_id": "directory.index", "name": "Directory Engine (entity/authority/evidence index model + federated DirectoryQuery)", "plane": "runtime", "constitution_ref": "constitution/17-DIRECTORY-SEARCH.md", "ssot_module": "private/runtime/directory-engine", "ssot_package": "@kye/directory-engine", "ssot_entry_point": "IndexClient + DirectoryQuery + AuthoritySearch + EvidenceFinder", "transport_wrappers": [], "notes": "Owns the index/query MODEL; the query SURFACE is search.query (kye-search-engine).", "competitor_forbidden_patterns": [ "function DirectoryQueryBuilder(", "const DirectoryQueryBuilder =", "class DirectoryQueryBuilder " ] }, { "concept_id": "durable-objects.classes", "name": "Durable Object class set (rate limiter, audit batcher, drift counter, replay cursor, dual-control broker)", "plane": "runtime", "constitution_ref": "constitution/16-EDGE-RUNTIME.md", "ssot_module": "private/runtime/durable-objects", "ssot_package": "@kye/durable-objects", "ssot_entry_point": "canonical Durable Object classes", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function DualControlBroker(", "const DualControlBroker =", "class DualControlBroker " ] }, { "concept_id": "edge.wrangler_config_predicate", "name": "Is this filename a wrangler config (any shape the repo uses)?", "plane": "runtime", "constitution_ref": "constitution/16-EDGE-RUNTIME.md", "ssot_module": "scripts/gates/_lib.mjs", "ssot_package": null, "ssot_entry_point": "isWranglerConfig(name) / WRANGLER_CONFIG_RE", "transport_wrappers": [], "competitor_forbidden_patterns": [ "name === \"wrangler.toml\"", "=== 'wrangler.toml'", "endsWith(\"wrangler.toml\")" ], "competitor_baseline_key": "implementation_canonical__competitors__edge_wrangler_config_predicate", "migration": { "status": "complete", "note": "Registered 2026-08-15. The literal `name === \"wrangler.toml\"` was re-typed in 18 scripts, which made cf-resource-governance-coverage blind to per-region and prefixed configs while reporting the fleet clean. The canonical existed from 2026-08-11 and one consumer had adopted it; an agent then nearly defined a SECOND copy inside the same file that already exported it." } }, { "concept_id": "email-action.token", "name": "Email-action one-click HMAC token", "plane": "auth", "constitution_ref": "constitution/27-COMMERCIAL-LIFECYCLE.md", "ssot_module": "public/site/functions/api/_lib/email-action-token.js", "ssot_package": null, "ssot_entry_point": "mintEmailActionToken / verifyEmailActionToken", "transport_wrappers": [ { "module": "public/site/functions/api/_lib/admin-action-buttons.js", "transport": "render", "note": "Canonical button-renderer used by every actionable admin notification (pilot, consultant, expert-review, key-rotation, etc.). Mints via the SSOT lib." }, { "module": "public/admin/functions/email-action.js", "transport": "dispatcher", "note": "Single canonical /email-action endpoint on admin.kyeprotocol.com. Verifies via the SSOT, enforces single-use via email_action_token_used, applies expert-review inline; queues every other domain to the per-domain consumer." } ], "secret_keys": [ "KYE_EMAIL_ACTION_SECRET_CURRENT", "KYE_EMAIL_ACTION_SECRET_PREVIOUS" ], "removed_competitors": [ "public/site/functions/api/_lib/expert-action-token.js (deleted 2026-05-23 — parallel HMAC lib with separate EXPERT_ACTION_SECRET)", "public/admin/functions/api/v1/expert-reviews/[id]/email-action.js (deleted 2026-05-23 — per-domain dispatcher)" ], "competitor_forbidden_patterns": [ "function verifyEmailActionToken(", "const verifyEmailActionToken =", "class verifyEmailActionToken " ] }, { "concept_id": "entity.resolve", "name": "Entity Engine (entity registry + KYEID parse/format/generate + faceted lookup)", "plane": "identity", "constitution_ref": "constitution/01-NAMING.md", "ssot_module": "private/runtime/entity-engine", "ssot_package": "@kye/entity-engine", "ssot_entry_point": "KYEID parse/format + entity registry", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function EntityRegistryError(", "const EntityRegistryError =", "class EntityRegistryError " ] }, { "concept_id": "entity.state", "name": "State Engine (six-dimension entity state vector + transitions)", "plane": "runtime", "constitution_ref": "constitution/18-OPERATING-MODEL.md", "ssot_module": "private/runtime/state-engine", "ssot_package": "@kye/state-engine", "ssot_entry_point": "state vector + deterministic transitions + invariant validation", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function StateEngine(", "const StateEngine =", "class StateEngine " ] }, { "concept_id": "evidence-import.bridge", "name": "Universal evidence importer — connectors → sealed evidence", "plane": "evidence", "constitution_ref": "constitution/13-RESILIENCE-LOOP.md", "ssot_module": "private/runtime/kye-evidence-import-worker", "ssot_package": null, "ssot_entry_point": "POST /v1/evidence-import", "transport_wrappers": [ { "module": "public/app/functions/api/v1/evidence-import.js", "transport": "pages-function", "note": "kye-app Pages Function that fronts the worker for the customer dashboard's connectors page; auth via tenant session, forwards to the worker with IMPORT_WORKER_BEARER." }, { "module": "public/widgets/evidence-import/v1", "transport": "embed-widget", "note": "Embeddable evidence-import widget (post-message conformant)." } ], "note": "Transport bridge — the worker hosts the canonical /v1/evidence-import HTTP surface that connector adapters and the embed widget post raw evidence batches to; the worker normalises and forwards to the canonical sealing pipeline. Not a stateful engine; no SSOT library because the canonical sealing logic lives downstream in the evidence-pack-assembler.", "competitor_forbidden_patterns": [ "function buildImportBatch(", "const buildImportBatch =", "class buildImportBatch " ] }, { "concept_id": "evidence.chain", "name": "Evidence Engine (Decision Map builder + Evidence Pack assembler core)", "plane": "evidence", "constitution_ref": "constitution/13-RESILIENCE-LOOP.md", "ssot_module": "private/runtime/evidence-engine", "ssot_package": "@kye/evidence-engine", "ssot_entry_point": "Decision Map builder + Evidence Pack assembler", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function assembleEvidencePackViaCustody(", "const assembleEvidencePackViaCustody =", "class assembleEvidencePackViaCustody " ] }, { "concept_id": "evidence.pack.assemble", "name": "Evidence Pack assembler", "plane": "evidence", "constitution_ref": "constitution/13-RESILIENCE-LOOP.md", "ssot_module": "private/runtime/evidence-pack-assembler", "ssot_package": null, "ssot_entry_point": "assemblePack(decisionId, fragments)", "transport_wrappers": [ { "module": "private/runtime/evidence-pack-sealer-periodic", "transport": "queue", "note": "Periodic sealer triggers assembly on a cron-tolerated cadence per §35" } ], "competitor_forbidden_patterns": [ "function makeAssembleMessage(", "const makeAssembleMessage =", "class makeAssembleMessage " ] }, { "concept_id": "gateway.dispatch", "name": "Gateway / PEP middleware", "plane": "runtime", "constitution_ref": "constitution/16-EDGE-RUNTIME.md", "ssot_module": "private/runtime/gateway", "ssot_package": "@kye/gateway", "ssot_entry_point": "createGateway(...)", "transport_wrappers": [ { "module": "private/runtime/gateway-worker", "transport": "http", "note": "Legacy CF Worker — being consolidated to kye-gateway-worker" }, { "module": "private/runtime/kye-gateway-worker", "transport": "http", "note": "Canonical CF Worker hosting the gateway library" } ], "competitor_forbidden_patterns": [ "function decideCapabilityInvocation(", "const decideCapabilityInvocation =", "class decideCapabilityInvocation " ] }, { "concept_id": "generator.write-targets", "name": "Generator write-target detection (which canonical paths a generator writes)", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md#0.49", "ssot_module": "scripts/lib/generator-writes.mjs", "ssot_entry_point": "writeTargetsIn(text)", "transport_wrappers": [ { "module": "scripts/build-cascade-edges.mjs", "transport": "import", "must_import": "./lib/generator-writes.mjs", "note": "Assigns cascade node kind. Previously carried its own matcher that knew writeFileSync + named constants but not the writeJson helper." }, { "module": "scripts/gates/generated-not-source.mjs", "transport": "import", "must_import": "../lib/generator-writes.mjs", "note": "Checks the label this builder assigns. Previously carried its own matcher that knew writeJson but could not resolve a named constant." } ], "competitor_forbidden_patterns": [ "function constPathsFor", "const WRITE_IDENT_RE", "WRITE_LITERAL_RE" ], "note": "An x-er/x-or class: 'which paths does a generator write' is a question two consumers ask and MUST NOT answer differently. They did — each had half the matcher — and the gap between the halves was 24 generated artefacts labelled kind=source-of-truth in the cascade graph, the exact set §53 §3.2 could then not protect from a silently-reverted hand-edit. Registered here so a third half-matcher fails the competitor scan instead of quietly becoming the fourth answer." }, { "concept_id": "html.escape", "name": "HTML escaper (text + quoted-attribute safe)", "plane": "surface", "constitution_ref": "constitution/00-INDEX.md#0.49", "ssot_module": "private/lib/html-escape", "ssot_entry_point": "escapeHtml(value)", "transport_wrappers": [ { "module": "private/runtime/kye-comms-engine-worker/src/compiler.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "private/runtime/reporting-engine/src/templates.ts", "transport": "import", "must_import": "@kye/html-escape", "note": "STRICT-TS PACKAGE, cannot take the projection. tsconfig sets rootDir 'src' + include 'src/**/*', so a file outside src is not in the program, and noImplicitAny rejects the canonical's untyped parameter. Its current copy is COMPLETE and correct (all five characters, null-safe) — this is a duplicate, not a defect, which is why it is time-boxed rather than rushed. Closure is to publish the SSOT as @kye/html-escape with types and add the dependency." }, { "module": "public/admin/functions/api/v1/pilot-applications/[id]/send-sign-in.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/admin/functions/email-action.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/admin/search.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Enrolled 2026-08-10 — this copy was introduced by the #1505 security sweep, which is exactly the copy-N+1 this concept exists to prevent." }, { "module": "public/app/assets/dashboard-realtime-components.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/app/assets/usage-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/app/coa/_assets/chrome.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/app/dashboard.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/app/document-governance.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/app/entity-passport.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Enrolled 2026-08-10 — this copy was introduced by the #1505 security sweep, which is exactly the copy-N+1 this concept exists to prevent." }, { "module": "public/app/ep/_assets/chrome.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/sandbox/estate-planning/assets/console.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Enrolled 2026-08-10 — this copy was introduced by the #1505 security sweep, which is exactly the copy-N+1 this concept exists to prevent." }, { "module": "public/sandbox/main.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/assets/site-authority-record.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/_lib/admin-action-buttons.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/_lib/consultant-emails.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/_lib/persona-intake.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/audit-pilot.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/consultant-lead.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/contact.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/dsar.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/engage-access.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/expert-review.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/functions/api/v1/poc/apply.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/main.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Enrolled 2026-08-10 — this copy was introduced by the #1505 security sweep, which is exactly the copy-N+1 this concept exists to prevent." }, { "module": "public/status/assets/status.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/widgets/action-approval/v1/widget.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/widgets/authority-scope/v1/widget.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/widgets/consultant-card/v1/index.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/widgets/critical-point-review/v1/widget.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/widgets/entity-passport/v1/widget.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/widgets/partner-registry/v1/index.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "scripts/build-ontology-derivative.mjs", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "site/src/fragments/admin/search.body.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Enrolled 2026-08-10 — this copy was introduced by the #1505 security sweep, which is exactly the copy-N+1 this concept exists to prevent." }, { "module": "site/src/fragments/app/dashboard.body.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "site/src/fragments/app/document-governance.body.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "site/src/fragments/app/entity-passport.body.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Enrolled 2026-08-10 — this copy was introduced by the #1505 security sweep, which is exactly the copy-N+1 this concept exists to prevent." }, { "module": "site/src/fragments/widgets/consultant-card/v1/home.tail.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "site/src/fragments/widgets/partner-registry/v1/home.tail.html", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical." }, { "module": "public/site/assets/expert-wall-form.js", "transport": "projection", "note": "Browser code — cannot import a Node module, so it carries the canonical bytes between the marker comments and implementation-canonical verifies the equality. Enrolled 2026-08-12 replacing a hand-rolled esc() that escaped & < > but NOT the double quote, while all eight of its call sites interpolate into DOUBLE-QUOTED HTML attributes (href, title, aria-label, data-cite, data-embed). `x\" onmouseover=\"alert(1)` passed through it unchanged. CodeQL js/incomplete-html-attribute-sanitization." }, { "module": "public/app/assets/apps-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/authorities-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/authority-wallet-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/classification-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/connectors-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/entities-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/plugins-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/purposes-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/replay-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." }, { "module": "public/app/assets/scopes-page.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14 with the Class-1 sanitization sweep: this page interpolated a DOM-attribute-sourced empty-state string into innerHTML (CodeQL js/xss-through-dom). It carried no escaper, so it is reached through the declared insertion marker." } ], "competitor_forbidden_patterns": [ "function escapeHtml(", "function escapeHTML(", "const escapeHtml =", "const escapeHTML =" ], "competitor_scan_extensions": [ ".html" ], "migration": { "status": "in-progress", "advisory_until": "2026-11-08", "tracked_in": "constitution/DECAY-WINDOWS.md", "wrappers_pending_import": [ "private/runtime/reporting-engine/src/templates.ts" ] } }, { "concept_id": "key.custody", "name": "Key Custody adapter (HSM/KMS-backed signing)", "plane": "runtime", "constitution_ref": "constitution/16-EDGE-RUNTIME.md", "ssot_module": "private/runtime/key-custody", "ssot_package": "@kye/key-custody", "ssot_entry_point": "AWS/GCP/Azure KMS + PKCS#11 HSM adapters", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function CKM_EC_EDWARDS_KEY_PAIR_GEN(", "const CKM_EC_EDWARDS_KEY_PAIR_GEN =", "class CKM_EC_EDWARDS_KEY_PAIR_GEN " ] }, { "concept_id": "learn.articles", "name": "Education-rail articles + glossary", "plane": "surface", "constitution_ref": "constitution/39-LEARN-RAIL.md", "ssot_module": "private/specs/learn", "ssot_package": null, "ssot_entry_point": "manifest.json + glossary.json", "transport_wrappers": [], "competitor_scan_exemption": { "reason": "Articles are content records in a manifest, not code; a duplicate is a second manifest entry rather than a second implementation.", "enforced_by": "learn-manifest-alive" } }, { "concept_id": "markdown.cell_escape", "name": "Markdown table-cell escaper", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md#0.49", "ssot_module": "private/lib/markdown-cell", "ssot_entry_point": "markdownCell(value)", "competitor_forbidden_patterns": [ "replace(/\\|/g", "function markdownCell(", "const markdownCell =" ], "competitor_baseline_key": "implementation_canonical__competitors__markdown_cell_escape", "transport_wrappers": [], "migration": { "status": "complete", "tracked_in": "private/specs/ratchets/baselines.json#implementation_canonical__competitors__markdown_cell_escape" } }, { "concept_id": "marketplace.registry", "name": "Marketplace Registry (rule-pack marketplace index/filter/trust-score/verify)", "plane": "billing", "constitution_ref": "constitution/31-DATA-GOVERNANCE-PACK.md", "ssot_module": "private/runtime/marketplace-registry", "ssot_package": "@kye/marketplace-registry", "ssot_entry_point": "index + filter + trust-score + signature-verify", "transport_wrappers": [ { "module": "private/runtime/marketplace-worker", "transport": "http", "note": "HTTP surface (Marketplace Rail)" } ], "competitor_forbidden_patterns": [ "function MarketplaceRegistry(", "const MarketplaceRegistry =", "class MarketplaceRegistry " ] }, { "concept_id": "mcp.tools", "name": "KYE MCP Server (locked KYE Protocol tool set over MCP)", "plane": "runtime", "constitution_ref": "constitution/15-MCP-AND-SDK.md", "ssot_module": "private/runtime/mcp-server", "ssot_package": "@kye/mcp-server", "ssot_entry_point": "MCP server (stdio transport)", "transport_wrappers": [ { "module": "private/runtime/kye-mcp-server-worker", "transport": "http", "note": "Streamable-HTTP MCP server Worker (§15)" } ], "competitor_forbidden_patterns": [ "function CONTROL_PLANE_TOOL_OUTPUT_SCHEMA(", "const CONTROL_PLANE_TOOL_OUTPUT_SCHEMA =", "class CONTROL_PLANE_TOOL_OUTPUT_SCHEMA " ] }, { "concept_id": "oscal.export", "name": "OSCAL Exporter (KYE evidence → NIST OSCAL JSON)", "plane": "audit", "constitution_ref": "constitution/21-DELEGATED-AUDITABILITY.md", "ssot_module": "private/runtime/oscal-exporter", "ssot_package": "@kye/oscal-exporter", "ssot_entry_point": "project evidence → OSCAL component-definition / SSP / assessment-results", "transport_wrappers": [ { "module": "private/runtime/kye-oscal-exporter-worker", "transport": "http", "note": "HTTP Worker (§21)" } ], "competitor_forbidden_patterns": [ "function exportComponentDefinition(", "const exportComponentDefinition =", "class exportComponentDefinition " ] }, { "concept_id": "policy.administration", "name": "Policy Administration Point (Operating Model → Compiled Authority Bundle compiler)", "plane": "decision", "constitution_ref": "constitution/25-EDGE-GOVERNANCE.md", "ssot_module": "private/runtime/pap", "ssot_package": "@kye/pap", "ssot_entry_point": "Control Compiler + signed Review Records", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function CONTROL_COMPILER_VERSION(", "const CONTROL_COMPILER_VERSION =", "class CONTROL_COMPILER_VERSION " ] }, { "concept_id": "policy.decision", "name": "Policy Decision (PDP)", "plane": "decision", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/pdp", "ssot_package": "@kye/pdp", "ssot_entry_point": "DecisionPoint.decide()", "transport_wrappers": [ { "module": "private/runtime/kye-pdp-worker", "transport": "http", "must_import": "@kye/pdp", "note": "CF Worker HTTP surface — Phase 1 import (stableHash) complete 2026-05-19; Phase 2 (full DecisionPoint adapter for resolvers + evidence sink) tracked separately" }, { "module": "private/runtime/epdp", "transport": "embedded", "must_import": "@kye/pdp", "note": "Embedded wrapper — imports canonicalJsonString from SSOT so HMAC-signed bundles hash bit-identically with central PDP" }, { "module": "private/runtime/spdp", "transport": "sidecar", "must_import": "@kye/pdp", "note": "Sidecar — exports adaptKyePdpAsUpstream() bridge so sidecar deployments host the SSOT DecisionPoint in-process" } ], "competitor_forbidden_patterns": [ "function NativePolicyEngineAdapter(", "const NativePolicyEngineAdapter =", "class NativePolicyEngineAdapter " ] }, { "concept_id": "purpose.admit", "name": "Purpose & Scope Engine (Purpose Permission admit/issue/revoke)", "plane": "decision", "constitution_ref": "constitution/12-PURPOSE-PERMISSION.md", "ssot_module": "private/runtime/purpose-engine", "ssot_package": "@kye/purpose-engine", "ssot_entry_point": "admit(grant, request, now, signals)", "transport_wrappers": [], "competitor_forbidden_patterns": [ "export function admit(" ], "migration": { "status": "in-progress", "advisory_until": "2026-08-29", "tracked_in": "constitution/DECAY-WINDOWS.md", "wrappers_pending_import": [ "private/runtime/gateway-worker", "private/runtime/mcp-server" ] } }, { "concept_id": "rate-limiting.tenant", "name": "Tenant rate-limiting (Durable Object backed; in-memory reference for tests)", "plane": "runtime", "constitution_ref": "constitution/16-EDGE-RUNTIME.md", "ssot_module": "private/runtime/gateway-worker", "ssot_package": null, "ssot_entry_point": "TenantRateLimiter Durable Object + src/middleware/ratelimit.ts", "transport_wrappers": [ { "module": "private/runtime/gateway", "transport": "library", "note": "In-process token-bucket reference for single-process tests at src/middleware/rate-limit.ts. The DO-backed limiter on gateway-worker is the production authority." } ], "competitor_forbidden_patterns": [ "function analyticsReplayEquivalenceRoute(", "const analyticsReplayEquivalenceRoute =", "class analyticsReplayEquivalenceRoute " ] }, { "concept_id": "render.comment_strip", "name": "Comment stripping for source scanners (code vs. prose)", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md", "ssot_module": "scripts/lib/strip-comments.mjs", "ssot_package": null, "ssot_entry_point": "stripComments(src, { dialect, preservePositions })", "transport_wrappers": [ { "module": "scripts/gates/_lib.mjs", "transport": "library", "must_import": "../lib/strip-comments.mjs", "note": "stripCodeComments(src, { html }) — the HTML-aware entry point. It adds ONLY the markup branch (blank comments, then lex script bodies as js and style bodies as css) and delegates every code-lexing decision to the canonical. It USED to carry its own lexer, and the two disagreed on 30 of 1200 files: in 14 this one deleted live code because its regex state did not track the character class in /[^/]+/, and in 14 it left whole comments unstripped. The SSOT moved here after that measurement — the more capable implementation (7 dialects, preservePositions, regex-vs-division by value position) wins, and the HTML branch it lacked is preserved by this wrapper." } ], "competitor_forbidden_patterns": [ "function stripComments(", "const stripComments =", "/\\/\\*[\\s\\S]*?\\*\\//g" ], "competitor_baseline_key": "implementation_canonical__competitors__render_comment_strip", "migration": { "status": "in-progress", "tracked_in": "private/specs/ratchets/baselines.json#implementation_canonical__competitors__render_comment_strip" } }, { "concept_id": "render.html_tag_match", "name": "HTML tag + comment matching for scanners (CodeQL js/bad-tag-filter class)", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md", "ssot_module": "public/oss/software-constitution/kit/lib/html-tags.mjs", "ssot_package": null, "ssot_entry_point": "htmlCommentRe() / rawTextElementRe(tag) / blankHtmlComments() / blankRawTextBodies()", "transport_wrappers": [ { "module": "scripts/lib/html-tags.mjs", "transport": "library", "must_import": "../../public/oss/software-constitution/kit/lib/html-tags.mjs", "note": "Re-export only, zero implementation. The canonical lives in the §42 kit because the kit is PUBLISHED and scaffolded into other repos: it imports nothing outside itself, so a copy there would ship its defects to every adopter. must_import is the mechanical proof this path forwards to the canonical instead of re-implementing it." } ], "competitor_forbidden_patterns": [ "<\\/script>", "<\\/style>", "" ], "competitor_baseline_key": "implementation_canonical__competitors__render_html_tag_match", "migration": { "status": "in-progress", "tracked_in": "private/specs/ratchets/baselines.json#implementation_canonical__competitors__render_html_tag_match" } }, { "concept_id": "replay.derive", "name": "Replay Engine (Execution Context Seal + Determinism Proof + Replay Proof)", "plane": "evidence", "constitution_ref": "constitution/13-RESILIENCE-LOOP.md", "ssot_module": "private/runtime/replay-engine", "ssot_package": "@kye/replay-engine", "ssot_entry_point": "context seal + determinism proof", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function DeterminismProver(", "const DeterminismProver =", "class DeterminismProver " ] }, { "concept_id": "replay.proof-generation", "name": "Replay-Proof™ generation (re-derive a decision from public signatures)", "plane": "evidence", "constitution_ref": "constitution/13-RESILIENCE-LOOP.md", "ssot_module": "private/runtime/replay-proof-generator", "ssot_package": null, "ssot_entry_point": "POST /v1/replay/derive — worker.js", "transport_wrappers": [], "competitor_scan_exemption": { "reason": "Proof generation is proven by OUTPUT EQUIVALENCE across engines, not by symbol uniqueness — two engines agreeing is the invariant, so a competing-symbol pattern would test the wrong thing.", "enforced_by": "engine-replay-equiv" } }, { "concept_id": "reporting.synthesize", "name": "Reporting Engine (per-framework compliance report synthesis)", "plane": "audit", "constitution_ref": "constitution/21-DELEGATED-AUDITABILITY.md", "ssot_module": "private/runtime/reporting-engine", "ssot_package": "@kye/reporting-engine", "ssot_entry_point": "per-framework report synthesis from the audit chain", "transport_wrappers": [ { "module": "private/runtime/kye-reporting-worker", "transport": "http", "note": "HTTP + cron period-close + auto-delivery Worker" }, { "module": "private/runtime/kye-reporting-agent-worker", "transport": "http", "note": "Reporting Agent Worker (§26 stakeholder reports). Overlap with kye-reporting-worker flagged for runtime-consolidation review." } ], "competitor_forbidden_patterns": [ "function sampleAuditChainRefs(", "const sampleAuditChainRefs =", "class sampleAuditChainRefs " ] }, { "concept_id": "risk.score", "name": "Risk Engine (canonical risk tier + 0..100 risk score)", "plane": "decision", "constitution_ref": "constitution/13-RESILIENCE-LOOP.md", "ssot_module": "private/runtime/risk-engine", "ssot_package": "@kye/risk-engine", "ssot_entry_point": "risk tier + score per EU AI Act floor", "transport_wrappers": [ { "module": "private/runtime/kye-risk-agent", "transport": "http", "note": "HTTP Worker — POST /v1/risk/assess" } ], "competitor_forbidden_patterns": [ "function RiskEngine(", "const RiskEngine =", "class RiskEngine " ] }, { "concept_id": "rules.evaluate", "name": "Rules Engine (rights/obligations/prohibitions/stop-conditions evaluator)", "plane": "decision", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/rules-engine", "ssot_package": "@kye/rules-engine", "ssot_entry_point": "evaluate(input, bundle) -> rule_result", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function RuleCompileError(", "const RuleCompileError =", "class RuleCompileError " ] }, { "concept_id": "rules.gateway", "name": "Rules Gateway (rule-pack evaluation surface)", "plane": "runtime", "constitution_ref": "constitution/29-PROFILES-LITE.md", "ssot_module": "private/runtime/rules-gateway", "ssot_package": "@kye/rules-gateway", "ssot_entry_point": "evaluate(...)", "transport_wrappers": [ { "module": "private/runtime/rules-gateway-worker", "transport": "http", "note": "CF Worker HTTP surface around the rules-gateway library" } ], "competitor_scan_exemption": { "reason": "The gateway's uniqueness question is orphan RULES rather than a duplicated symbol — a second rule set, not a second evaluate(). The operating-model gate answers that question directly.", "enforced_by": "om-no-orphan-rules" } }, { "concept_id": "search.query", "name": "KYE Native Search Engine™ (D1 FTS5 lexical + Vectorize semantic query surface)", "plane": "runtime", "constitution_ref": "constitution/17-DIRECTORY-SEARCH.md", "ssot_module": "private/runtime/kye-search-engine", "ssot_package": "kye-search-engine", "ssot_entry_point": "POST /v1/search — worker.ts (F34 entitlement gate + F37 classification floor + F38 risk-tier cap + Ed25519-signed envelope + §0.3 audit emission)", "transport_wrappers": [ { "module": "private/runtime/kye-search-indexer-worker", "transport": "queue", "note": "Index refresher — rebuilds the native D1 FTS5 + Vectorize substrate (cron full/incremental + kye-search-delta queue)." } ], "notes": "Pre-cutover legacy-search dead code at private/runtime/search/ deleted. The three legacy Cloudflare search workers were decommissioned 2026-08-05 (deleted via the Cloudflare API); native D1 FTS5 + Vectorize is the one search substrate.", "competitor_forbidden_patterns": [ "function buildFtsQuery(", "const buildFtsQuery =", "class buildFtsQuery " ] }, { "concept_id": "siem.export", "name": "SIEM Export (audit-log shipping to Splunk/Sentinel/Elastic/Datadog)", "plane": "audit", "constitution_ref": "constitution/14-AGENTS-AND-ENGINES.md", "ssot_module": "private/runtime/siem-export", "ssot_package": "@kye/siem-export", "ssot_entry_point": "push/pull SIEM shipping per tenant_siem_targets", "transport_wrappers": [ { "module": "private/runtime/kye-siem-export-worker", "transport": "http", "note": "Streaming Worker (§14)" } ], "competitor_forbidden_patterns": [ "function sentinelCanonicalString(", "const sentinelCanonicalString =", "class sentinelCanonicalString " ] }, { "concept_id": "sql.like_escape", "name": "LIKE-pattern escaper for a user-supplied search term", "plane": "surface", "constitution_ref": "constitution/00-INDEX.md#0.49", "ssot_module": "private/lib/sql-like", "ssot_entry_point": "escapeLike(value)", "competitor_forbidden_patterns": [ "replace(/[%_]/g", "function escapeLike(", "const escapeLike =" ], "competitor_baseline_key": "implementation_canonical__competitors__sql_like_escape", "transport_wrappers": [ { "module": "public/app/functions/api/v1/search.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. A Pages Function cannot import from private/ (§33 IP/OSS line), so projection is the transport, exactly as for html.escape and url.safe." }, { "module": "public/admin/functions/api/v1/search.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. A Pages Function cannot import from private/ (§33 IP/OSS line), so projection is the transport, exactly as for html.escape and url.safe." }, { "module": "public/admin/functions/api/v1/issuers.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. A Pages Function cannot import from private/ (§33 IP/OSS line), so projection is the transport, exactly as for html.escape and url.safe." }, { "module": "public/admin/functions/api/v1/evidence-index.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. A Pages Function cannot import from private/ (§33 IP/OSS line), so projection is the transport, exactly as for html.escape and url.safe." } ], "migration": { "status": "complete", "tracked_in": "private/specs/ratchets/baselines.json#implementation_canonical__competitors__sql_like_escape" } }, { "concept_id": "toolchain.version_pin", "name": "Which exact version of an external toolchain component does KYE run?", "plane": "governance", "constitution_ref": "constitution/00-INDEX.md", "ssot_module": "private/specs/toolchain/deploy-toolchain.json", "ssot_package": null, "ssot_entry_point": "tools[].channels[].version (exact x.y.z, enforced by scripts/gates/deploy-toolchain-pinned.mjs)", "transport_wrappers": [], "competitor_forbidden_patterns": [ "node-version: '2", "node-version: \"2" ], "competitor_baseline_key": "implementation_canonical__competitors__toolchain_version_pin", "migration": { "status": "complete", "note": "Registered 2026-08-15. The registry is tool-generic but held ONE member (wrangler) while node was pinned by hand 38 times across .github/workflows, four of them on an EOL major. Nobody noticed because there was no canonical version to drift FROM — the unpopulated-registry defect." } }, { "concept_id": "ui.cache-bust", "name": "Cache-bust value used on every static asset URL", "plane": "surface", "constitution_ref": "constitution/06-WEBSITE.md", "ssot_module": "scripts/sync-marketing-counters.mjs", "ssot_package": null, "ssot_entry_point": "rolling value applied via 'npm run fix:consistency'", "transport_wrappers": [], "competitor_scan_exemption": { "reason": "The cache-bust value is a rolling STRING stamped across assets, not a callable symbol, so a second copy is a second value rather than a second function definition — a §40 pattern cannot see it.", "enforced_by": "cache-bust-canonical" } }, { "concept_id": "ui.chrome", "name": "Site chrome (top-bar, footer, breadcrumbs, drawer)", "plane": "surface", "constitution_ref": "constitution/02-INFORMATION-ARCHITECTURE.md", "ssot_module": "public/site/assets/components.js", "ssot_package": null, "ssot_entry_point": "TOP_BAR_HUB_IDS + FOOTER_GROUPS + kyeTopBar() + kyeFooter() + kyeBreadcrumbs() + kyeDrawer()", "transport_wrappers": [], "competitor_forbidden_patterns": [ "function kyeCalloutDelegatedAuditability(", "const kyeCalloutDelegatedAuditability =", "class kyeCalloutDelegatedAuditability " ] }, { "concept_id": "ui.theme-bootstrap", "name": "UI theme bootstrap (dark/light + brand tokens)", "plane": "surface", "constitution_ref": "constitution/04-DESIGN-SYSTEM.md", "ssot_module": "public/site/assets/theme-bootstrap.js", "ssot_package": null, "ssot_entry_point": "theme-bootstrap.js (default export)", "transport_wrappers": [], "competitor_scan_exemption": { "reason": "theme-bootstrap.js is a browser bootstrap loaded by a script tag with no named export to key on; a competing copy is a second injected script, which the theme freshness gate detects.", "enforced_by": "theme-canonical-fresh" } }, { "concept_id": "url.safe", "name": "URL sink guard (scheme allow-list for href/src)", "plane": "surface", "constitution_ref": "constitution/00-INDEX.md#0.49", "ssot_module": "private/lib/safe-url", "ssot_entry_point": "safeUrl(value)", "competitor_forbidden_patterns": [ "function safeUrl(", "const safeUrl =" ], "competitor_scan_extensions": [ ".html" ], "transport_wrappers": [ { "module": "public/site/assets/video-library.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14: four sinks assigned a DOM-attribute URL straight to href/src (CodeQL js/xss-through-dom), where a javascript: value executes on click." }, { "module": "public/site/assets/demos.js", "transport": "projection", "note": "Byte-projected by scripts/build-html-escape-projection.mjs; equality verified by implementation-canonical. Added 2026-08-14: setAttribute('src', …) from a data- attribute (CodeQL js/xss-through-dom)." } ] }, { "concept_id": "webhook.signature.verify", "name": "Inbound webhook signature verification (KYE-Timestamp + KYE-Signature + KYE-Delivery-ID HMAC scheme per private/specs/webhooks/signing.md)", "plane": "runtime", "constitution_ref": "constitution/06-WEBSITE.md", "ssot_module": "private/runtime/webhook-dispatcher", "ssot_package": null, "ssot_entry_point": "verify({ body, headers, resolveSecret, isDeliveryFresh }) — see src/verify.ts", "transport_wrappers": [], "notes": "Vendor schemes (Svix in public/site/functions/webhooks/clerk.js, Stripe-Signature in public/admin/functions/webhooks/stripe.js) are vendor-specific and out of scope — they implement the vendor's signing protocol, not the KYE one. Legacy in-process v1 verifier at private/runtime/gateway/src/webhook-verifier.ts was DELETED 2026-05-19 (zero non-test callers; consolidation complete).", "competitor_forbidden_patterns": [ "function parseSignatureHeader(", "const parseSignatureHeader =", "class parseSignatureHeader " ] }, { "concept_id": "content.page_facet_similarity", "name": "Page relatedness in the §50 content graph (facet vocabulary + similarity)", "plane": "governance", "constitution_ref": "constitution/50-CONTENT-GRAPH-DISCOVERABILITY.md", "ssot_module": "scripts/lib/page-facets.mjs", "ssot_package": null, "ssot_entry_point": "facetSet(discoverability) / facetSimilarity(a, b)", "transport_wrappers": [ { "module": "scripts/build-derived-search.mjs", "transport": "library", "must_import": "./lib/page-facets.mjs", "note": "computeRelated() ranks by score then url. It owned the facet-set construction and the Jaccard body until this concept was registered; the RANKING stays here because it legitimately differs per surface." }, { "module": "scripts/lib/archetypes.mjs", "transport": "library", "must_import": "./page-facets.mjs", "note": "renderRouter() ranks by similarity, then §50 buyer-journey stage, then title. It did NOT share the search index's relation — it required an audience match AND an exact kye-topic intersection, and §50 §2 declares kye-topic FREE-FORM, so no two pages share one verbatim. Measured: badges.html scored zero routes on all three of its audiences, the router returned null, and the page kept a disclosure where its kind requires a control. The two relations disagreed silently because an empty route list and an undefined relation are indistinguishable at the call site." } ], "competitor_forbidden_patterns": [ "new Set\\(\\); *for \\(const a of .*\\) .*add\\(`a:", "\\.some\\(\\(t\\) => topics\\.has\\(t\\)\\)" ], "competitor_baseline_key": "implementation_canonical__competitors__content_page_facet_similarity", "migration": { "status": "complete", "tracked_in": "private/specs/ratchets/baselines.json#implementation_canonical__competitors__content_page_facet_similarity" } } ] }