Skip to main content

OSS Inventory

jhf-reed OSS Version Truth

This document defines the canonical repo-owned entry points for OSS inventory and upgrade readiness in jhf-reed.

Canonical Files​

  • maintenance/oss-inventory.json
  • maintenance/oss-version-truth.json
  • maintenance/oss-upgrade-policy.json
  • maintenance/fabric-oss-upgrade-consumer.json

These files are machine-readable and must stay aligned with ownership boundaries:

  • repo-owned runtime/verifier surfaces are pinned and validated locally
  • external-owner lanes are referenced explicitly and never shadowed locally
  • Fabric-owned OSS upgrade truth is consumed read-only from canonical upstream contracts

Universal Connections W0 candidates​

Issue JaddaHelpifyr/jhf-reed#194 records five upstream families as planned_not_admitted: Activepieces Community Pieces, ToolHive, the MCP SDK/spec family, Playwright, and Stagehand. They have upstream provenance owners and expected source types, but deliberately have no selected version, digest, runtime, dependency, or production admission. A Beam watch source, selected version and digest, Beam certification evidence, and Fabric admission are all required before Fabric may reconsider Reed's current central-directory exclusion.

The canonical local files remain the four files above. The plan-facing names are compatibility names, not additional files:

  • maintenance/fabric-oss-upgrade-consumer-contract.json resolves to maintenance/fabric-oss-upgrade-consumer.json.
  • maintenance/oss-drift-contract.json resolves to maintenance/oss-upgrade-policy.json#/candidate_drift_rules.
  • maintenance/upgrade-paths.json resolves to maintenance/oss-upgrade-policy.json#/candidate_upgrade_path_rules.

The machine-readable decision and owner readback live in the canonical consumer binding. No alias file or second truth is created.

W7 Activepieces Compatibility Contract (UC-REE-02)​

Issue JaddaHelpifyr/jhf-reed#190 (UC-REE-02, W7) is a repository-only, read-only compatibility spike. It pins one exact opaque Activepieces community piece (@activepieces/piece-http 0.11.18, immutable sha512 digest) in a dedicated W7 contract and proves a fail-closed denial posture with 21 negative vectors. It does not install, connect, execute, or admit any Activepieces engine, database, flow, credential, or provider surface.

  • Contract: contracts/provider/activepieces-compat/reed_activepieces_compat_v1.json
  • Schema: contracts/provider/activepieces-compat/reed_activepieces_compat_v1.schema.json
  • Negative vectors: contracts/tests/reed_activepieces_compat_vectors_v1.json (21)
  • Doc: docs/ACTIVEPIECES_COMPAT_V1.md
  • Verifier: scripts/verify_reed_activepieces_compat.py --check
  • Tests: tests/test_reed_activepieces_compat.py

The W0 inventory truth is unchanged in substance: the Activepieces family remains planned_not_admitted with version_pin=null and artifact_digest=null. The exact W7 pin lives only in the W7 contract. A Beam watch source remains an open gap owned by jhf-beam#641; no monitoring/sources/ file is added.

W8 ToolHive/MCP Compatibility Contract (UC-REE-03)​

Issue JaddaHelpifyr/jhf-reed#191 (UC-REE-03, W8) is a repository-only, read-only MCP compatibility spike. It binds the immutable MCP protocol revision 2025-06-18 and a repo-only LKG ref, and proves a fail-closed denial posture with 27 negative vectors covering sandbox hardening (plan §7.4), feature allowlist (§3.8), protocol revision watch, LKG/rollback, kill-chaos, protocol drift, revoked bindings, and wave-boundary claims. It does not install, connect, execute, or admit any ToolHive server, MCP registry, engine, database, flow, credential, or provider surface.

  • Contract: contracts/provider/mcp-toolhive/reed_mcp_toolhive_v1.json
  • Schema: contracts/provider/mcp-toolhive/reed_mcp_toolhive_v1.schema.json
  • Negative vectors: contracts/tests/reed_mcp_toolhive_vectors_v1.json (27)
  • Doc: docs/TOOLHIVE_MCP_V1.md
  • Verifier: scripts/verify_reed_mcp_toolhive.py --check
  • Tests: tests/test_reed_mcp_toolhive.py

The W0 inventory truth is unchanged in substance: the toolhive-runtime family remains planned_not_admitted with version_pin=null and artifact_digest=null. The protocol pin and LKG ref live only in the W8 contract. A Beam watch source remains an open gap owned by jhf-beam#641; no monitoring/sources/ file is added.

W9 OpenAPI/HTTP Compatibility Contract (UC-REE-04)​

Issue JaddaHelpifyr/jhf-reed#192 (UC-REE-04, W9) is a repository-only, read-only OpenAPI/HTTP compatibility spike. It binds the OpenAPI spec family to the immutable versions 3.0.3, 3.0.4, 3.1.0, and 3.1.1, pins provider origins with SSRF denial (private range, DNS rebinding, metadata), and proves a fail-closed denial posture with 38 negative vectors covering Heddle/Keystore auth, GET/HEAD method mapping, bounded pagination, rate-limit authority, bounded 202 polling, partial-batch closeout, SSRF fixtures, LKG/rollback, drift, and wave-boundary claims. It does not install, connect, execute, or admit any HTTP provider runtime, engine, database, flow, credential, or provider surface.

  • Contract: contracts/provider/openapi-http/reed_openapi_http_v1.json
  • Schema: contracts/provider/openapi-http/reed_openapi_http_v1.schema.json
  • Negative vectors: contracts/tests/reed_openapi_http_vectors_v1.json (38)
  • Doc: docs/OPENAPI_HTTP_V1.md
  • Verifier: scripts/verify_reed_openapi_http.py --check
  • Tests: tests/test_reed_openapi_http.py

There is no W0 OpenAPI/HTTP candidate family: verify_reed_oss_inventory.py keeps its pinned five-family UC_CANDIDATE_IDS, and no maintenance/oss-*.json file is touched. The spec pin and LKG ref live only in the W9 contract. A Beam watch source remains an open gap owned by jhf-beam#641; no monitoring/sources/ file is added.

W10 Playwright/Stagehand Browser Compatibility Contract (UC-REE-05)​

Issue JaddaHelpifyr/jhf-reed#193 (UC-REE-05, W10) is a repository-only, read-only Playwright/Stagehand browser compatibility spike. It binds the automation family to the immutable mechanisms playwright and stagehand, one browser session per node with bounded session budgets (plan §6.3), a §7.4 sandbox, fail-closed navigation, a read-only execution policy, 30-day raw-trace evidence retention, the B3 gate with B4 deny, model residency, and Dobby promotion, and proves a fail-closed denial posture with 57 negative vectors covering sandbox hardening, navigation denial, evidence retention, budgets, LKG/rollback, drift, and wave-boundary claims. It does not install, connect, execute, or admit any browser runtime, engine, session, provider, credential, or live browser lane.

  • Contract: contracts/provider/browser/reed_browser_v1.json
  • Schema: contracts/provider/browser/reed_browser_v1.schema.json
  • Negative vectors: contracts/tests/reed_browser_vectors_v1.json (57)
  • Doc: docs/BROWSER_V1.md
  • Verifier: scripts/verify_reed_browser.py --check
  • Tests: tests/test_reed_browser.py

Playwright and Stagehand are existing W0 candidates (playwright-runtime, stagehand-runtime in UC_CANDIDATE_IDS): verify_reed_oss_inventory.py keeps its pinned five-family UC_CANDIDATE_IDS unchanged, and no maintenance/oss-*.json file is touched. The automation pin and LKG ref live only in the W10 contract. A Beam watch source remains an open gap owned by jhf-beam#641; no monitoring/sources/ file is added.

Owner Boundary Rules​

  • jhf-reed owns only its repo-local OSS/runtime verifier truth.
  • helpifyr-fabric#289, jhf-openclaw-env#209, and jhf-deployment#270 remain external owner lanes.
  • No local workaround or shadow truth is allowed for those external lanes.
  • helpifyr-fabric is canonical source for OSS update/upgrade contracts and module identity/directory truth.

Fabric Consumer Surfaces​

jhf-reed consumes these upstream Fabric surfaces fail-closed:

  • contracts/platform/platform_version_truth.json
  • contracts/platform/platform_projection_catalog.json
  • contracts/platform/platform_oss_upgrade_governance_v1.json
  • contracts/platform/platform_oss_upgrade_compatibility_matrix_v1.json
  • contracts/platform/platform_oss_upgrade_evidence_contract_v1.json
  • contracts/platform/helpifyr_stack_module_identity_v1.json
  • contracts/platform/stack_tool_oss_inventory_directory.json
  • docs/contracts/HELPIFYR_PLATFORM_OSS_UPGRADE_GOVERNANCE.md
  • docs/contracts/HELPIFYR_STACK_MODULE_IDENTITY.md
  • docs/contracts/HELPIFYR_STACK_TOOL_OSS_INVENTORY_DIRECTORY.md

Verify Path​

  • python scripts/verify_reed_oss_inventory.py --check
  • python scripts/verify_reed_activepieces_compat.py --check
  • python scripts/verify_reed_mcp_toolhive.py --check
  • python scripts/verify_reed_openapi_http.py --check
  • python scripts/verify_reed_browser.py --check
  • powershell -File scripts/verify-reed-oss-inventory.ps1
  • python scripts/verify_fabric_oss_upgrade_consumer.py
  • python scripts/verify_reed_templates.py
  • powershell -File scripts/verify-reed-templates.ps1

Acceptance Posture​

  • no floating latest markers on repo-owned components
  • each component has explicit ownership (repo_owned or external_owner)
  • each external lane has explicit owner repo + issue reference
  • missing/unreadable/version-mismatched Fabric OSS consumer surfaces fail verification
  • a missing UC candidate, missing provenance/source posture, premature admission, fabricated version/digest, auto-adoption, or silent fallback fails verification

License Metadata Boundary​

Every component must declare license, license_class, and license_evidence_url. Until component-specific evidence and Fabric policy #1540 or #1541 exist, the only valid posture is NOASSERTION / unknown_blocked with the ANYFER legal reference. This inventory does not approve redistribution, managed hosting, publication, or a component license.

License​

This document is part of an AGPLv3 repository. Helpifyr project information is available at https://helpifyr.com.