{
  "flows": [
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "crates/crank-metrics/tests/schema_v1.rs",
          "crates/crank-metrics/tests/cardinality.rs",
          "crates/crank-observability/tests/http_metrics.rs"
        ],
        "manual": [
          "docs/observability.md"
        ]
      },
      "id": "api-typed-metrics-foundation",
      "owner": "observability-community",
      "requirements": [
        "FR-32",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Operators receive a versioned low-cardinality technical metrics contract with bounded Prometheus and OpenMetrics exposition."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/login.spec.js",
          "apps/ui/tests/e2e/workspace-settings.spec.js"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "ui-auth-workspace",
      "owner": "admin-ui-community",
      "requirements": [
        "FR-3",
        "FR-46"
      ],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can authenticate and work in the selected Community workspace."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/operations.spec.js",
          "apps/ui/tests/e2e/wizard.spec.js",
          "apps/ui/tests/e2e/operation-lifecycle.spec.js"
        ],
        "manual": [
          "docs/manual-regression-checklist.md"
        ]
      },
      "id": "ui-operation-lifecycle",
      "owner": "operations-ui-community",
      "requirements": [
        "FR-1",
        "FR-46"
      ],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can create, edit, publish, archive, and inspect REST Operations."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/wizard.spec.js"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "ui-operation-test",
      "owner": "runtime-ui-community",
      "requirements": [
        "FR-2",
        "FR-46"
      ],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can execute a bounded Operation test and inspect its safe outcome."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/operation-lifecycle.spec.js",
          "apps/ui/tests/e2e/wizard.spec.js"
        ],
        "manual": [
          "docs/manual-regression-checklist.md"
        ]
      },
      "id": "ui-operation-import-export",
      "owner": "import-ui-community",
      "requirements": [
        "FR-1",
        "FR-46"
      ],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can import OpenAPI or YAML drafts and export an Operation configuration."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/agents.spec.js"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "ui-agent-management",
      "notes": "Story 1.13 added catalog_revision display, serialized lifecycle controls and stale-conflict recovery evidence, but full Agent lifecycle UX remains blocked until production-grade Draft/Published editing flows are manually qualified.",
      "owner": "agents-ui-community",
      "requirements": [
        "FR-4",
        "FR-46"
      ],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can manage an Agent and its published Operation bindings."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/api-keys.spec.js",
          "apps/admin-api/tests/integration/credential_lifecycle.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "ui-mcp-approval-keys",
      "owner": "keys-ui-community",
      "requirements": [
        "FR-3",
        "FR-5",
        "FR-46"
      ],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can create, reveal once, inspect, revoke, and terminal-soft-delete MCP or approval keys without retaining raw key material in the UI."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/secrets.spec.js",
          "apps/ui/tests/e2e/wizard.spec.js"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "ui-auth-profiles-upstreams-secrets",
      "owner": "credentials-ui-community",
      "requirements": [
        "FR-3",
        "FR-46"
      ],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can configure reusable upstream, Auth Profile, and secret references without re-reading plaintext."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/logs-usage.spec.js"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "ui-logs-approvals",
      "owner": "history-ui-community",
      "requirements": [
        "FR-5",
        "FR-6",
        "FR-46"
      ],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can inspect invocation logs, safe request/trace details, filter by outcome, export CSV, and inspect pending approvals."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/logs-usage.spec.js"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "ui-usage",
      "owner": "usage-ui-community",
      "requirements": [
        "FR-6",
        "FR-46"
      ],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can inspect workspace, Operation, Agent, and safe outcome-group usage summaries."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/auth_rate_limit.rs",
          "apps/admin-api/tests/integration/community_access_usage.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "api-auth-workspace",
      "owner": "admin-api-community",
      "requirements": [
        "FR-3",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Authenticated Admin API requests are scoped to the authorized Community workspace."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/operation_lifecycle.rs",
          "crates/crank-registry/tests/integration/operations_artifacts.rs"
        ],
        "manual": [
          "docs/admin-api.md"
        ]
      },
      "id": "api-operation-lifecycle",
      "owner": "operations-api-community",
      "requirements": [
        "FR-1",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage immutable published Operation versions and drafts."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/operations_agents.rs",
          "crates/crank-adapter-rest/tests/integration/client.rs",
          "crates/crank-adapter-rest/tests/integration/outbound_security.rs",
          "crates/crank-runtime/tests/stages.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "api-operation-test-run",
      "owner": "runtime-api-community",
      "requirements": [
        "FR-2",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can execute a REST Operation test through the current runtime boundary."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/operation_lifecycle.rs",
          "apps/admin-api/tests/integration/secrets_import_auth.rs"
        ],
        "manual": [
          "docs/admin-api.md"
        ]
      },
      "id": "api-operation-import-export",
      "owner": "import-api-community",
      "requirements": [
        "FR-1",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can preview and create OpenAPI imports and round-trip YAML configuration."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/agent_catalog.rs",
          "apps/admin-api/tests/integration/operations_agents.rs",
          "crates/crank-registry/tests/integration/agents_usage.rs"
        ],
        "manual": [
          "docs/admin-api.md"
        ]
      },
      "id": "api-agent-catalog",
      "owner": "agents-api-community",
      "requirements": [
        "FR-4",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage revision-preconditioned Agent drafts, exact Published Operation bindings, immutable Published Agent Versions, publication, and catalog search policy."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/community_access_usage.rs",
          "apps/admin-api/tests/integration/credential_lifecycle.rs",
          "apps/mcp-server/tests/integration/catalog_access.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "api-mcp-approval-keys",
      "owner": "keys-api-community",
      "requirements": [
        "FR-3",
        "FR-5",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage separately scoped MCP and approval keys with a single raw disclosure, origin enforcement, immediate revocation, terminal soft-delete, and safe audit evidence."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/secrets_import_auth.rs",
          "apps/admin-api/tests/integration/credential_lifecycle.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "api-auth-profiles-upstreams-secrets",
      "owner": "credentials-api-community",
      "requirements": [
        "FR-3",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage upstreams, Auth Profiles, encrypted secret references, atomic Secret rotation, and safe credential audit evidence."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "crates/crank-runtime/src/secret_crypto.rs",
          "crates/crank-registry/tests/integration/master_key_identity.rs",
          "apps/admin-api/tests/migration_command.rs",
          "apps/admin-api/tests/config_startup.rs",
          "apps/mcp-server/tests/config_startup.rs"
        ],
        "manual": [
          "docs/secrets-and-auth.md",
          "docs/migrations.md"
        ]
      },
      "id": "api-master-key-identity-rotation",
      "owner": "credentials-api-community",
      "requirements": [
        "FR-3",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Operators can verify one active non-secret master-key identity across Admin and MCP processes and rotate the key through a durable preflight, resume, verify, promote or abort workflow."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/community_access_usage.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "api-approvals",
      "owner": "approvals-api-community",
      "requirements": [
        "FR-5",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can list and inspect approval requests without leaking unsafe payloads."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/logs_usage.rs",
          "apps/admin-api/tests/integration/community_access_usage.rs",
          "apps/admin-api/tests/dc08.rs",
          "crates/crank-registry/tests/integration/agents_usage.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "api-logs-usage",
      "owner": "history-api-community",
      "requirements": [
        "FR-6",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can query safe cursor-paginated invocation history, log details, CSV export, and usage summaries with UTC half-open periods and outcome groups."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/mcp-server/tests/integration/transport_protocol.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "mcp-transport-session",
      "owner": "mcp-transport-community",
      "requirements": [
        "FR-3",
        "FR-4",
        "FR-46"
      ],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An authorized MCP client can initialize and terminate a bounded Streamable HTTP session."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/mcp-server/tests/integration/transport_protocol.rs",
          "apps/mcp-server/tests/integration/catalog_access.rs",
          "crates/crank-registry/tests/integration/agents_usage.rs"
        ],
        "manual": [
          "docs/mcp-interface.md"
        ]
      },
      "id": "mcp-published-tool-list",
      "owner": "mcp-catalog-community",
      "requirements": [
        "FR-4",
        "FR-46"
      ],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An MCP client sees only bound, authorized, immutable published Tool versions for its Agent."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/mcp-server/tests/integration/transport_protocol.rs",
          "apps/mcp-server/tests/integration/execution_stages.rs",
          "crates/crank-adapter-rest/tests/integration/client.rs",
          "crates/crank-adapter-rest/tests/integration/outbound_security.rs",
          "crates/crank-runtime/tests/stages.rs"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "mcp-published-tool-call",
      "owner": "mcp-runtime-community",
      "requirements": [
        "FR-2",
        "FR-4",
        "FR-6",
        "FR-46"
      ],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An MCP client can invoke an authorized published REST Tool and receive a safe structured outcome."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/mcp-server/tests/integration/tool_search.rs",
          "apps/mcp-server/tests/integration/catalog_access.rs"
        ],
        "manual": [
          "docs/mcp-interface.md"
        ]
      },
      "id": "mcp-scoped-tool-search",
      "owner": "mcp-catalog-community",
      "requirements": [
        "FR-4",
        "FR-46"
      ],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An MCP client can use Agent-scoped search meta-tools without escaping its published catalog, and stale search results are rejected by catalog_revision."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/mcp-server/tests/integration/catalog_access/approval_access.rs",
          "crates/crank-registry/tests/integration/approval.rs",
          "crates/crank-registry/tests/integration/migrations.rs",
          "apps/ui/tests/e2e/approvals.spec.js"
        ],
        "manual": [
          "docs/capability-baseline/manual-checklist.md"
        ]
      },
      "id": "mcp-approval-lifecycle",
      "owner": "mcp-approvals-community",
      "requirements": [
        "FR-5",
        "FR-46"
      ],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "A separately authorized approval client can list and decide pending requests with bounded side effects."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/request_context.rs",
          "apps/mcp-server/tests/integration/request_context.rs",
          "apps/mcp-server/tests/integration/execution_stages.rs",
          "crates/crank-registry/tests/integration/migrations.rs"
        ],
        "manual": [
          "docs/observability.md"
        ]
      },
      "id": "api-canonical-request-trace-identity",
      "owner": "observability-community",
      "requirements": [
        "FR-27",
        "FR-46"
      ],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin and MCP requests expose separate safe Request and Trace identities that survive runtime execution and history persistence without requiring telemetry export."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "tests/unit/test_validate_capability_inventory.py"
        ],
        "manual": [
          "docs/intro.md"
        ]
      },
      "id": "planned-production-foundation",
      "owner": "platform-community",
      "requirements": [
        "FR-7",
        "FR-8",
        "FR-9",
        "FR-10",
        "FR-11",
        "FR-12",
        "FR-13",
        "FR-14",
        "FR-28",
        "FR-29",
        "FR-30",
        "FR-31",
        "FR-33",
        "FR-34",
        "FR-35"
      ],
      "status": "planned",
      "type": "api",
      "user_outcome": "Community runtime, safety, correlation, and observability foundations reach their planned production contracts."
    },
    {
      "capabilities": [
        "resources"
      ],
      "evidence": {
        "automated": [
          "tests/unit/test_validate_capability_inventory.py"
        ],
        "manual": [
          "docs/intro.md"
        ]
      },
      "id": "planned-resource-read",
      "owner": "mcp-community",
      "requirements": [
        "FR-15",
        "FR-16",
        "FR-46"
      ],
      "status": "planned",
      "type": "mcp",
      "user_outcome": "MCP clients can discover and read published Resources."
    },
    {
      "capabilities": [
        "prompts"
      ],
      "evidence": {
        "automated": [
          "tests/unit/test_validate_capability_inventory.py"
        ],
        "manual": [
          "docs/intro.md"
        ]
      },
      "id": "planned-prompt-get",
      "owner": "mcp-community",
      "requirements": [
        "FR-17",
        "FR-18",
        "FR-19",
        "FR-46"
      ],
      "status": "planned",
      "type": "mcp",
      "user_outcome": "MCP clients can list and render published parameterized Prompts."
    },
    {
      "capabilities": [
        "tasks"
      ],
      "evidence": {
        "automated": [
          "tests/unit/test_validate_capability_inventory.py"
        ],
        "manual": [
          "docs/intro.md"
        ]
      },
      "id": "planned-background-task",
      "owner": "execution-community",
      "requirements": [
        "FR-20",
        "FR-21",
        "FR-22",
        "FR-23",
        "FR-24",
        "FR-25",
        "FR-26",
        "FR-46"
      ],
      "status": "planned",
      "type": "mcp",
      "user_outcome": "Users can observe and control durable background executions."
    },
    {
      "capabilities": [
        "load_runs"
      ],
      "evidence": {
        "automated": [
          "tests/unit/test_validate_capability_inventory.py"
        ],
        "manual": [
          "docs/intro.md"
        ]
      },
      "id": "planned-load-run",
      "owner": "quality-community",
      "requirements": [
        "FR-36",
        "FR-37",
        "FR-38",
        "FR-39",
        "FR-40",
        "FR-41",
        "FR-46"
      ],
      "status": "planned",
      "type": "ui",
      "user_outcome": "Administrators can run a bounded load scenario and inspect its quality statistics."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "tests/unit/test_validate_capability_inventory.py"
        ],
        "manual": [
          "docs/intro.md"
        ]
      },
      "id": "planned-community-deployment",
      "owner": "release-community",
      "requirements": [
        "FR-42",
        "FR-43",
        "FR-44",
        "FR-45",
        "FR-46"
      ],
      "status": "planned",
      "type": "api",
      "user_outcome": "Operators can deploy, upgrade, restore, and operate a production Community installation."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "tests/unit/test_validate_capability_inventory.py"
        ],
        "manual": [
          "docs/intro.md"
        ]
      },
      "id": "planned-release-qualification",
      "owner": "quality-community",
      "requirements": [
        "FR-47",
        "FR-48",
        "FR-49",
        "FR-50",
        "FR-51",
        "FR-52",
        "FR-53",
        "FR-54"
      ],
      "status": "planned",
      "type": "api",
      "user_outcome": "A release candidate is qualified by immutable, reproducible technical and manual evidence."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/admin-api/tests/integration/onboarding.rs",
          "crates/crank-registry/tests/integration/onboarding.rs",
          "apps/mcp-server/tests/onboarding.rs"
        ],
        "manual": [
          "docs/admin-api.md"
        ]
      },
      "id": "api-onboarding-first-call",
      "notes": "Implementation is present in the uncommitted Story 1.16 worktree. This baseline deliberately remains blocked until a clean source revision and collector-produced automated reports exist; no result is inferred from source files.",
      "owner": "onboarding-api-community",
      "requirements": [
        "FR-1",
        "FR-4",
        "FR-33"
      ],
      "status": "blocked",
      "type": "api",
      "user_outcome": "Authenticated Community administrators receive an authoritative workspace onboarding projection and safe exact first public MCP Tool-call evidence."
    },
    {
      "capabilities": [
        "tools"
      ],
      "evidence": {
        "automated": [
          "apps/ui/tests/e2e/onboarding.spec.js"
        ],
        "manual": [
          "docs/manual-regression-checklist.md"
        ]
      },
      "id": "ui-onboarding-first-call",
      "notes": "Automated and five-participant manual evidence must be recorded against a clean revision. The manual protocol is explicitly not_run in this baseline and does not constitute a release usability pass.",
      "owner": "onboarding-ui-community",
      "requirements": [
        "FR-1",
        "FR-4",
        "FR-33"
      ],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "A new self-hosted administrator can resume the optional Getting Started journey from manual REST Operation to an authoritative public MCP Tool call without retaining raw key material."
    }
  ],
  "product": "crank-community",
  "schema_version": 1
}