The audit read as prose, so a role could sit under a classification nobody had checked against its own declaration, and "blocked" could not be told apart from "nobody looked". The sections are now named after the exact values a role declares, which makes the section titles the vocabulary: one rule holds every role under its own declared classification, a second rejects a classification outside the vocabulary, and a third requires a named blocker per blocked role while forbidding a blocked role from shipping an enabled surface.
The report itself is generated from the roles' own metadata and a drift check imports the generator and compares against the committed file, which caught a stale report twice while this work was in progress. It lives under docs/contributing rather than beside the requirements, because a generated file in that directory reads like a finished criterion.
The criteria across seven requirement files now carry what they rest on: what closed them, or what blocks them and where that was measured. Two coverage limits stay stated rather than hidden: the report is built only from roles that declare an MCP block, so a role blocked without one is invisible to it, and a ticked criterion here means implemented and tested rather than proven in operation.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
031, 032 and 033 named meta/schema.yml as the place credentials live, which
481666bdb renamed to meta/secrets.yml. 035 named role scripts without their
language folder, which dfe7a7fdd introduced.
Not cosmetic: a wrong location in a requirement costs real time. 036 asserted
that .running and group_names agree on a single-host round, and acting on
that claim configured every AI consumer with the openrouter/auto vendor model
until the gateway rejected it.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Tick 41 criteria across the MCP and AI requirements, each against a file
that carries the content or a line in a deploy log, leaving anything that
merely looked plausible unchecked.
Reword five criteria the implementation contradicted. Credentials now
follow their origin: a secret this deployment generates stays a vault
credential, one the application issues cannot be, because the vault
cannot generate it. OpenProject is licence-gated rather than pending.
Flowise prepares its instance rather than registering servers, since it
exposes no registry to register them in. A client is held to the server
list only where upstream offers one.
Replace the five audit-artifact criteria with three that describe what
the tree actually enforces. The generator and its committed file were
dropped: once every fact moved into the role that owns it, the artifact
was a copy that could only go stale, and grep answers the same question.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
kevinveenbirkenbachandClaude Opus 5