{
  "flows": [
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["crates/crank-metrics/tests/schema_v1.rs", "crates/crank-metrics/tests/cardinality.rs", "crates/crank-observability/tests/http_metrics.rs"], "manual": ["docs/observability.md"]},
      "id": "api-typed-metrics-foundation",
      "owner": "observability-community",
      "requirements": ["FR-32", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Operators receive a versioned low-cardinality technical metrics contract with bounded Prometheus and OpenMetrics exposition."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/login.spec.js", "apps/ui/tests/e2e/workspace-settings.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-auth-workspace",
      "owner": "admin-ui-community",
      "requirements": ["FR-3", "FR-46"],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can authenticate and work in the selected Community workspace."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/operations.spec.js", "apps/ui/tests/e2e/wizard.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-operation-lifecycle",
      "owner": "operations-ui-community",
      "requirements": ["FR-1", "FR-46"],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can create, edit, publish, archive, and inspect REST Operations."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/wizard.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-operation-test",
      "owner": "runtime-ui-community",
      "requirements": ["FR-2", "FR-46"],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can execute a bounded Operation test and inspect its safe outcome."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/operations.spec.js", "apps/ui/tests/e2e/wizard.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-operation-import-export",
      "owner": "import-ui-community",
      "requirements": ["FR-1", "FR-46"],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can import OpenAPI or YAML drafts and export an Operation configuration."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/agents.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-agent-management",
      "owner": "agents-ui-community",
      "requirements": ["FR-4", "FR-46"],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can manage an Agent and its published Operation bindings."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/api-keys.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-mcp-approval-keys",
      "owner": "keys-ui-community",
      "requirements": ["FR-3", "FR-5", "FR-46"],
      "status": "implemented",
      "type": "ui",
      "user_outcome": "An administrator can create, reveal once, inspect, revoke, and delete MCP or approval keys."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/secrets.spec.js", "apps/ui/tests/e2e/wizard.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-auth-profiles-upstreams-secrets",
      "owner": "credentials-ui-community",
      "requirements": ["FR-3", "FR-46"],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can configure reusable upstream, Auth Profile, and secret references without re-reading plaintext."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/logs-usage.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-logs-approvals",
      "owner": "history-ui-community",
      "requirements": ["FR-5", "FR-6", "FR-46"],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can inspect invocation logs, safe details, and pending approvals."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/ui/tests/e2e/logs-usage.spec.js"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "ui-usage",
      "owner": "usage-ui-community",
      "requirements": ["FR-6", "FR-46"],
      "status": "blocked",
      "type": "ui",
      "user_outcome": "An administrator can inspect workspace, Operation, and Agent usage summaries."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/auth_rate_limit.rs", "apps/admin-api/tests/integration/community_access_usage.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-auth-workspace",
      "owner": "admin-api-community",
      "requirements": ["FR-3", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Authenticated Admin API requests are scoped to the authorized Community workspace."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/operations_agents.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-operation-lifecycle",
      "owner": "operations-api-community",
      "requirements": ["FR-1", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage immutable published Operation versions and drafts."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/operations_agents.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-operation-test-run",
      "owner": "runtime-api-community",
      "requirements": ["FR-2", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can execute a REST Operation test through the current runtime boundary."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/openapi_import.rs", "apps/admin-api/tests/integration/secrets_import_auth.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-operation-import-export",
      "owner": "import-api-community",
      "requirements": ["FR-1", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can preview and create OpenAPI imports and round-trip YAML configuration."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/operations_agents.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-agent-catalog",
      "owner": "agents-api-community",
      "requirements": ["FR-4", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage Agent revisions, exact bindings, publication, and catalog search policy."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/community_access_usage.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-mcp-approval-keys",
      "owner": "keys-api-community",
      "requirements": ["FR-3", "FR-5", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage separately scoped MCP and approval keys with a single raw disclosure."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/secrets_import_auth.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-auth-profiles-upstreams-secrets",
      "owner": "credentials-api-community",
      "requirements": ["FR-3", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can manage upstreams, Auth Profiles, and encrypted secret references."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/community_access_usage.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-approvals",
      "owner": "approvals-api-community",
      "requirements": ["FR-5", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can list and inspect approval requests without leaking unsafe payloads."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/community_access_usage.rs", "apps/admin-api/tests/dc08.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "api-logs-usage",
      "owner": "history-api-community",
      "requirements": ["FR-6", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin API clients can query safe invocation history and usage summaries."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/mcp-server/tests/integration/transport_protocol.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "mcp-transport-session",
      "owner": "mcp-transport-community",
      "requirements": ["FR-3", "FR-4", "FR-46"],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An authorized MCP client can initialize and terminate a bounded Streamable HTTP session."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/mcp-server/tests/integration/transport_protocol.rs", "apps/mcp-server/tests/integration/catalog_access.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "mcp-published-tool-list",
      "owner": "mcp-catalog-community",
      "requirements": ["FR-4", "FR-46"],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An MCP client sees only bound, authorized, published Tool versions for its Agent."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/mcp-server/tests/integration/transport_protocol.rs", "apps/mcp-server/tests/integration/execution_stages.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "mcp-published-tool-call",
      "owner": "mcp-runtime-community",
      "requirements": ["FR-2", "FR-4", "FR-6", "FR-46"],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An MCP client can invoke an authorized published REST Tool and receive a safe structured outcome."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/mcp-server/tests/integration/tool_search.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "mcp-scoped-tool-search",
      "owner": "mcp-catalog-community",
      "requirements": ["FR-4", "FR-46"],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "An MCP client can use Agent-scoped search meta-tools without escaping its published catalog."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/mcp-server/tests/integration/catalog_access/approval_access.rs"], "manual": ["docs/capability-baseline/manual-checklist.md"]},
      "id": "mcp-approval-lifecycle",
      "owner": "mcp-approvals-community",
      "requirements": ["FR-5", "FR-46"],
      "status": "implemented",
      "type": "mcp",
      "user_outcome": "A separately authorized approval client can list and decide pending requests with bounded side effects."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["apps/admin-api/tests/integration/request_context.rs", "apps/mcp-server/tests/integration/request_context.rs", "apps/mcp-server/tests/integration/execution_stages.rs", "crates/crank-registry/tests/integration/migrations.rs"], "manual": ["docs/observability.md"]},
      "id": "api-canonical-request-trace-identity",
      "owner": "observability-community",
      "requirements": ["FR-27", "FR-46"],
      "status": "implemented",
      "type": "api",
      "user_outcome": "Admin and MCP requests expose separate safe Request and Trace identities that survive runtime execution and history persistence without requiring telemetry export."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["tests/unit/test_validate_capability_inventory.py"], "manual": ["docs/intro.md"]},
      "id": "planned-production-foundation",
      "owner": "platform-community",
      "requirements": ["FR-7", "FR-8", "FR-9", "FR-10", "FR-11", "FR-12", "FR-13", "FR-14", "FR-28", "FR-29", "FR-30", "FR-31", "FR-33", "FR-34", "FR-35"],
      "status": "planned",
      "type": "api",
      "user_outcome": "Community runtime, safety, correlation, and observability foundations reach their planned production contracts."
    },
    {
      "capabilities": ["resources"],
      "evidence": {"automated": ["tests/unit/test_validate_capability_inventory.py"], "manual": ["docs/intro.md"]},
      "id": "planned-resource-read",
      "owner": "mcp-community",
      "requirements": ["FR-15", "FR-16", "FR-46"],
      "status": "planned",
      "type": "mcp",
      "user_outcome": "MCP clients can discover and read published Resources."
    },
    {
      "capabilities": ["prompts"],
      "evidence": {"automated": ["tests/unit/test_validate_capability_inventory.py"], "manual": ["docs/intro.md"]},
      "id": "planned-prompt-get",
      "owner": "mcp-community",
      "requirements": ["FR-17", "FR-18", "FR-19", "FR-46"],
      "status": "planned",
      "type": "mcp",
      "user_outcome": "MCP clients can list and render published parameterized Prompts."
    },
    {
      "capabilities": ["tasks"],
      "evidence": {"automated": ["tests/unit/test_validate_capability_inventory.py"], "manual": ["docs/intro.md"]},
      "id": "planned-background-task",
      "owner": "execution-community",
      "requirements": ["FR-20", "FR-21", "FR-22", "FR-23", "FR-24", "FR-25", "FR-26", "FR-46"],
      "status": "planned",
      "type": "mcp",
      "user_outcome": "Users can observe and control durable background executions."
    },
    {
      "capabilities": ["load_runs"],
      "evidence": {"automated": ["tests/unit/test_validate_capability_inventory.py"], "manual": ["docs/intro.md"]},
      "id": "planned-load-run",
      "owner": "quality-community",
      "requirements": ["FR-36", "FR-37", "FR-38", "FR-39", "FR-40", "FR-41", "FR-46"],
      "status": "planned",
      "type": "ui",
      "user_outcome": "Administrators can run a bounded load scenario and inspect its quality statistics."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["tests/unit/test_validate_capability_inventory.py"], "manual": ["docs/intro.md"]},
      "id": "planned-community-deployment",
      "owner": "release-community",
      "requirements": ["FR-42", "FR-43", "FR-44", "FR-45", "FR-46"],
      "status": "planned",
      "type": "api",
      "user_outcome": "Operators can deploy, upgrade, restore, and operate a production Community installation."
    },
    {
      "capabilities": ["tools"],
      "evidence": {"automated": ["tests/unit/test_validate_capability_inventory.py"], "manual": ["docs/intro.md"]},
      "id": "planned-release-qualification",
      "owner": "quality-community",
      "requirements": ["FR-47", "FR-48", "FR-49", "FR-50", "FR-51", "FR-52", "FR-53", "FR-54"],
      "status": "planned",
      "type": "api",
      "user_outcome": "A release candidate is qualified by immutable, reproducible technical and manual evidence."
    }
  ],
  "product": "crank-community",
  "schema_version": 1
}