Skip to main content

Capabilities

Tool / Contract Summary​

jhf-deployment executes deployment codification and verification against upstream truth. It is an execution/evidence substrate, not a runtime semantic authority.

Canonical machine-readable feature truth: docs/MODULE_FEATURES.md.

Stable External Capabilities​

capability key: fabric_contract_governance_read​

  • Title: Fabric governance contract consumption
  • Stability: stable
  • Exposure: external read-only consumer
  • Primary API surface / command / artifact / file:
    • GET /api/v1/contracts/matrix
    • GET /api/v1/contracts/docs-standard
    • scripts/verify-fabric-contract-governance.py
    • maintenance/fabric-contract-consumption.json

capability key: fabric_combinations_optional_slices_read​

  • Title: Fabric combinations and optional-slice consumption
  • Stability: stable
  • Exposure: external read-only consumer
  • Primary API surface / command / artifact / file:
    • GET /api/v1/combinations/profiles
    • GET /api/v1/combinations/optional-slices
    • GET /api/v1/combinations/optional-slices/sipgate-carrier-cti
    • environments/test/scripts/verify-optional-sipgate-cti-prep.sh

capability key: operator_lane_recovery_standard_consumer​

  • Title: Fabric operator-lane recovery standard consumption
  • Stability: stable
  • Exposure: internal governance / review-closeout gate
  • Primary API surface / command / artifact / file:
    • maintenance/operator-lane-recovery-consumption.json
    • scripts/validate-operator-lane-recovery-consumption.py
    • docs/CODEX_AUTONOMOUS_ISSUE_PR_LOOP.md
    • docs/CODEX_PR_REVIEW_SESSION_IDENTITY.md

capability key: host_runtime_preflight_postdeploy_verify​

  • Title: Host runtime preflight and postdeploy verification
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/scripts/verify-host-runtime-preflight.sh
    • environments/test/scripts/verify-host-postdeploy-runtime-state.sh
    • environments/test/runtime/host-runtime-preflight-contract.json
    • includes fail-closed shuttle self-stack N8N_API_KEY source/mirror gate with deprecated-path cleanup (shuttle_n8n_api_key_bootstrap_contract)

capability key: cpu_safe_runtime_guardrails_policy_verify​

  • Title: CPU-safe runtime guardrails v1 policy verification (No-Repeat, low-pressure)
  • Stability: stable
  • Exposure: internal contract/policy gate
  • Primary API surface / command / artifact / file:
    • scripts/validate-cpu-safe-runtime-guardrails.py
    • maintenance/cpu-safe-runtime-guardrails-consumption.json
    • environments/test/scripts/diagnostic-docker-logs.sh
    • environments/test/scripts/run-host-pressure-guarded.sh

capability key: vaultwarden_supported_write_path_verify​

  • Title: Vaultwarden projection/write-path verification
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/scripts/verify-vaultwarden-supported-write-path.sh
    • docs/VAULTWARDEN_PROJECTION_CONTRACT.md
    • tests/fixtures/vaultwarden-*.json

capability key: keystore_first_principal_bootstrap_verify​

  • Title: Keystore first-principal bootstrap execution contract verify
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/scripts/verify-keystore-first-principal-bootstrap.sh
    • scripts/verify-keystore-first-principal-bootstrap.py
    • maintenance/keystore-first-principal-bootstrap-consumption.json

capability key: sso_v4_auth_rollout_verify​

  • Title: Deployment-owned SSO v4 native/bridge auth rollout verification
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/runtime/sso-v4-auth-rollout-contract.json
    • maintenance/sso-v4-auth-rollout-consumption.json
    • scripts/validate-sso-v4-auth-rollout-contract.py
    • environments/test/scripts/verify-sso-v4-auth-rollout.sh

capability key: sso_v4_proxy_auth_rollout_verify​

  • Title: Deployment-owned SSO v4 proxy-auth rollout verification for non-native surfaces
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/runtime/sso-v4-proxy-auth-rollout-contract.json
    • maintenance/sso-v4-proxy-auth-rollout-consumption.json
    • scripts/validate-sso-v4-proxy-auth-rollout-contract.py
    • environments/test/scripts/verify-sso-v4-proxy-auth-rollout.sh

capability key: voice_windows_audio_dependency_verify​

  • Title: Windows tray-owned Voxtral runtime dependency verification for integrated voice lane
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/runtime/voice-windows-audio-dependency-contract.json
    • maintenance/voice-windows-audio-dependency-consumption.json
    • scripts/validate-voice-windows-audio-dependency-contract.py
    • environments/test/scripts/verify-voice-windows-audio-dependency.sh

capability key: realtime_voice_v6_materialization_verify​

  • Title: Realtime Voice v6 Wave-1 deployment materialization contract verification
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/runtime/realtime-voice-v6-materialization-contract.json
    • maintenance/realtime-voice-v6-materialization-consumption.json
    • scripts/validate-realtime-voice-v6-materialization-contract.py
    • environments/test/scripts/verify-realtime-voice-v6-materialization.sh

capability key: realtime_voice_v6_wave2_warm_gateway_materialization_verify​

  • Title: Realtime Voice v6 Wave-2 warm gateway runtime materialization contract verification
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/runtime/realtime-voice-v6-wave2-warm-gateway-contract.json
    • maintenance/realtime-voice-v6-wave2-warm-gateway-consumption.json
    • scripts/validate-realtime-voice-v6-wave2-warm-gateway-contract.py
    • environments/test/scripts/verify-realtime-voice-v6-wave2-warm-gateway.sh

capability key: openclaw_native_tts_provider_materialization_verify​

  • Title: OpenClaw native TTS provider materialization contract verification for Tenter A/B readback
  • Stability: stable
  • Exposure: operator-facing command surface
  • Primary API surface / command / artifact / file:
    • environments/test/runtime/openclaw-native-tts-provider-materialization-contract.json
    • maintenance/openclaw-native-tts-provider-materialization-consumption.json
    • scripts/validate-openclaw-native-tts-provider-materialization-contract.py
    • environments/test/scripts/verify-openclaw-native-tts-provider-materialization.sh

Stable Internal Capabilities​

capability key: terraform_test_lifecycle​

  • Title: Terraform lifecycle orchestration (test environment)
  • Stability: stable
  • Exposure: internal script/CLI
  • Primary API surface / command / artifact / file:
    • environments/test/scripts/preflight.sh
    • environments/test/scripts/plan.sh
    • environments/test/scripts/create.sh
    • environments/test/scripts/verify.sh
    • environments/test/scripts/destroy.sh
    • environments/test/scripts/reset.sh

capability key: stack_ownership_and_legacy_guardrails​

  • Title: Stack ownership enforcement and legacy/retired runtime gates
  • Stability: stable
  • Exposure: internal verify gate
  • Primary API surface / command / artifact / file:
    • environments/test/runtime/deployment-stack-ownership-contract.json
    • environments/test/scripts/verify-host-runtime-preflight.sh
    • environments/test/scripts/verify-host-postdeploy-runtime-state.sh
    • environments/test/scripts/decommission-legacy-n8n-production-nats.sh

capability key: seed_aware_herp_swatch_profile​

  • Title: HERP/Swatch seed-aware sandbox profile checks
  • Stability: stable
  • Exposure: internal deploy/verify profile
  • Primary API surface / command / artifact / file:
    • docs/HERP_SWATCH_PROFILE.md
    • environments/test/scripts/run-herp-swatch-profile.sh
    • environments/test/scripts/verify-herp-swatch-profile.sh
    • environments/test/scripts/verify-herp-swatch-sandbox-isolation.sh

Experimental Or Transitional Capabilities​

capability key: first_owner_runtime_materialization​

  • Title: one-time HERP first-owner runtime environment materialization
  • Stability: transitional
  • Exposure: operator-only, value-blind runtime preparation
  • Primary API surface / command / artifact / file:
    • contracts/first-owner-runtime-materialization-v1.json
    • scripts/materialize-first-owner-runtime-env.sh
    • docs/FIRST_OWNER_RUNTIME_RUNBOOK.md

capability key: hetzner_staging_skeleton​

  • Title: bounded Hetzner staging skeleton
  • Stability: transitional
  • Exposure: internal Terraform profile
  • Primary API surface / command / artifact / file:
    • environments/hetzner-staging/

capability key: wave_handoff_contract_slices​

  • Title: cross-repo handoff contract slices (Wave tracks)
  • Stability: transitional
  • Exposure: internal contract consumer
  • Primary API surface / command / artifact / file:
    • docs/FABRIC_WAVE8_DEPLOYMENT_HANDOFF.md
    • docs/FABRIC_WAVE9_PROVIDER_FEDERATION_HANDOFF.md

Current Gaps​

  • no runtime service ownership
  • no local Fabric semantic truth authoring
  • no local secret authority
  • no autonomous cross-repo orchestration outside explicit issue scope
  • no admitted Plan Studio deployment handoff contract is implemented yet; raw planning drafts and approval-state truth are not valid deployment inputs

Producer-/Consumer-Zuordnung​

  • Producer truth:
    • helpifyr-fabric (contracts/combinations)
    • specialist repos (runtime semantics)
  • Consumer/materializer:
    • jhf-deployment

Compatibility Window​

  • contract-family/version window is pinned in:
    • maintenance/fabric-contract-consumption.json

Lifecycle Status​

  • status: active
  • mode: issue-driven deploy/verify

Readiness / Drift / Monitoring​

  • readiness proof is artifact-based (test-results/*.json)
  • deployment-owned drift is fail-fast
  • external ownership drift is surfaced as blocker evidence, never silently bypassed

Deployment / Verify​

terraform fmt -check -recursive
python3 scripts/export-fabric-metadata.py --check
python3 maintenance/verify-maintenance-contracts.py
bash scripts/fabric-selfcheck.sh

Live host verify example:

bash environments/test/scripts/verify-host-runtime-preflight.sh --host <internal-runtime-redacted> --output test-results/host-runtime-preflight.json

Known Limits​

  • live verification depends on reachable host/runtime and required credentials
  • owner-external outages remain external blockers

Exceptions / Waivers​

  • must be issue-linked, explicit, and time-bounded
  • issue history and closure evidence: docs/issues/

License: AGPLv3 Source and governance: https://helpifyr.com