OSS Inventory

This document defines the repo-owned OSS inventory/version readiness surface for jhf-shuttle#141.

Canonical Files

• inventory: maintenance/oss-inventory.json
• version truth: maintenance/oss-version-truth.json
• upgrade policy: maintenance/oss-upgrade-policy.json
• owner upgrade truth: maintenance/oss-upgrade-owner-truth.v1.json
• Fabric consumer binding: maintenance/fabric_oss_upgrade_consumer_binding.v1.json
• verifier: scripts/verify_oss_inventory_version_truth.py
• binding verifier: scripts/verify_fabric_oss_upgrade_consumer_binding.py

Legal Metadata Posture

Every components[] entry additionally requires:

• license: an approved SPDX identifier or NOASSERTION
• license_class: permissive, copyleft_container_ok, special_terms, non_oss, or unknown_blocked
• license_evidence_url: a whitespace-free HTTP(S) evidence URL

The current inventory is deliberately unreviewed: every component uses NOASSERTION, unknown_blocked, and https://anyfer.com/legal. A future reviewed classification requires a component-specific evidence URL, an approved SPDX identifier, and a Fabric decision reference to JaddaHelpifyr/helpifyr-fabric#1540 or #1541. This metadata records a fail-closed review posture; it does not approve distribution, managed hosting, public publication, or a component license.

Fabric Canonical Upstream Truth (Read-Only)

• contracts/platform/platform_version_truth.json
• contracts/platform/platform_projection_catalog.json
• contracts/platform/platform_oss_upgrade_governance_v1.json
• contracts/platform/platform_oss_upgrade_compatibility_matrix_v1.json
• contracts/platform/platform_oss_upgrade_evidence_contract_v1.json
• contracts/platform/helpifyr_stack_module_identity_v1.json
• contracts/platform/stack_tool_oss_inventory_directory.json
• docs/contracts/HELPIFYR_PLATFORM_OSS_UPGRADE_GOVERNANCE.md
• docs/contracts/HELPIFYR_STACK_MODULE_IDENTITY.md
• docs/contracts/HELPIFYR_STACK_TOOL_OSS_INVENTORY_DIRECTORY.md

Shuttle consumes these as Fabric-owned truth via read-only snapshots under:

• contracts/fabric_upstream/platform/
• docs/fabric_upstream/contracts/

Scope

• inventory all upgrade-relevant OSS/runtime/CI components for this repository
• keep repo-owned components pinned (pinned_exact), except for the single explicit Gitea CI runner label alias workflow.runner.gitea_ci = ubuntu-latest
• classify floating external surfaces explicitly as external_owner + blocked_external
• require the repo OCI root Docker base to stay digest-pinned so shared-runner builds do not drift across Debian base refreshes
• reject latest and unclassified floating drift for repo-owned components; ubuntu-latest is allowed only for workflow.runner.gitea_ci and must remain machine-declared as the dedicated runner-alias exception
• fail closed when Fabric consumer snapshots are missing, stale, or hash-mismatched
• fail closed when owner upgrade truth misses required upgrade/evidence/rollback fields
• fail closed when a component lacks legal metadata, duplicates another component ID, or claims a reviewed license without SPDX, component evidence, and Fabric decision evidence

Owner Upgrade Fields (Machine-Readable)

Each relevant OSS family in maintenance/oss-upgrade-owner-truth.v1.json carries:

• current_version
• target_version (or explicit owner-controlled posture)
• allowed_version_range
• pinning_posture
• compatibility_window_ref
• preflight_assertion_refs
• postdeploy_assertion_refs
• rollback_contract_ref
• evidence_contract_ref

Verify Path

Local:

python scripts/verify_oss_inventory_version_truth.py
python scripts/verify_fabric_oss_upgrade_consumer_binding.py
python -m pytest -q tests/test_verify_oss_inventory_version_truth.py
python -m pytest -q tests/test_verify_fabric_oss_upgrade_consumer_binding.py

CI:

• .gitea/workflows/ci.yml runs python scripts/verify_oss_inventory_version_truth.py
• a non-zero verifier exit fails the lane (fail-closed)

Optional live (runtime-relevant slices only):

ssh <internal-runtime-redacted><internal-runtime-redacted> "docker ps --format '{{.Names}}\t{{.Status}}' | grep -E '^jhf-shuttle-'"

External Owner Dependencies

• JaddaHelpifyr/helpifyr-fabric#289
• JaddaHelpifyr/jhf-openclaw-env#209
• JaddaHelpifyr/jhf-deployment#270

These dependencies are referenced in inventory/policy for surfaces where this repo is not the final upgrade owner.

AGPLv3. Learn more at helpifyr.com.

<!-- BEGIN HELPIFYR CANONICAL OSS INVENTORY -->

Canonical repository OSS inventory v2

The machine-readable source of truth is maintenance/oss-inventory.json; the pinned schema and repo-local verifier are schemas/repository-oss-inventory.schema.json and scripts/verify_repository_oss_inventory.py.

• Observed commit: 1e5ee5139573a9af72e2e6c23b0535b19e9d0450
• Status: complete
• Generated: 2026-08-25T11:49:36Z
• Valid until: 2026-09-24T11:49:36Z

Component	Scope	Current truth
python:3.11-slim@sha256:9358444059ed78e2975ada2c189f1c1a3144a5dab6f35bff8c981afb38946634	base-image	9358444059ed78e2975ada2c189f1c1a3144a5dab6f35bff8c981afb38946634
n8nio/n8n:2.16.1	direct-runtime	2.16.1
nats:2.12.6-alpine	direct-runtime	2.12.6-alpine
natsio/nats-box:0.17.0	direct-runtime	0.17.0
aiohttp	direct-runtime	==3.12.15
nats-py	direct-runtime	==2.11.0
n8nio/n8n:2.16.1	direct-runtime	2.16.1
n8nio/n8n:2.16.1	direct-runtime	2.16.1
n8nio/runners:2.16.1	direct-runtime	2.16.1
nats:2.12.6-alpine	direct-runtime	2.12.6-alpine
natsio/nats-box:0.17.0	direct-runtime	0.17.0
aiohttp	direct-runtime	>=3.9,<4.0
n8nio/n8n	direct-runtime	2.16.1
n8nio/n8n	direct-runtime	2.16.1
n8nio/n8n	direct-runtime	2.16.1
nats	direct-runtime	2.12.6-alpine
nats	direct-runtime	2.12.6-alpine
natsio/nats-box	direct-runtime	0.17.0
natsio/nats-box	direct-runtime	0.17.0
python	direct-runtime	3.12-slim
ubuntu-runner	direct-runtime	ubuntu-latest
ubuntu-runner	direct-runtime	ubuntu-24.04
ubuntu-runner	direct-runtime	ubuntu-24.04
actions/checkout	direct-runtime	v4
actions/setup-python	direct-runtime	v5
actions/upload-artifact	direct-runtime	v3
pytest	direct-runtime	>=7.0
pytest-cov	direct-runtime	>=4.0
setuptools	direct-runtime	>=45
wheel	direct-runtime	unbounded

Readiness blockers

No unresolved evidence findings were reported by the generator. Update this inventory in the same change as any dependency, image, base-image, build-tool or deployment-manifest change. Beam remains read/compare/test/prepare only; Deployment remains plan-only until owner approval and rollback gates.