Governance and Policy Enforcement

11 of 18 capability source symbols found|2 of them authored stronger-claims|7 open|coverage 611/1000|adoption 5 full / 6 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

evidence|grounded 11/12|unsupported 1|gates green 1/1|proven able to fail 0/1|never bitten 1|green at 0/0 0|open gaps 6|of them unnamed 0|of them proof withheld 0|flips ready 3

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 12 vs present 12 · named + unnamed + withheld = 6 vs open 6 · both reconcile

liar-kill conj=gPQN · first failing conjunct: grounded

graded document: BUILDROOT tree, 6109 bytes · gates map: PRIMARY · stamped 1d 13h ago · source ../knowledge/status/evstamp_warden.verdict

Ranking source binding: PLAN_MATRIX_BOUND_ONLY. Recorded priorities require current acceptance evidence and resource checks before execution.

Ranking matches the captured plan and matrix only. Latest execution outcome, research freshness, accepted delivery and investment return are unverified.

Recorded priority estimates

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: listed before new work by this heuristic. Priority is not measured delivery cost or execution readiness. Stamp: # asof=1790081831 domain=warden target_version=0.1 rungs=6 done=0 open=6 finish=0 ranker=nx_dr_ocm

Declared roadmap — contract, acceptance, executor, effort

Milestones

Rung dossiers — every record that bears on a rung, in one place

dossiers=6 cells_joined=6 no_matrix_row=0 (sum 6) gates_recorded=0 gates_unrecorded=0 no_gate_declared=6 (sum 6 of cells_joined) evgates=UNSTAMPED

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

players 5|matrix rows 18|feature mass 43|centrality mean 637|distinctiveness mean 352|axes 5|spine days 10 (shown 10)|rows written today 0|readability defects 2D 0 cube 0|spine knowledge/status/cdmap/warden.spine

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 72, unassessed 0. Authored assessments are not verified outcomes.

No capabilities match this filter or search.

Person · product · place — not yet measured for this domain

The field — discovered, not chosen

Rows written by nx_field_discover from warden.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

field candidates 3|shown 3 of 3|matrix columns in the field 3 of 4|discovered rivals with no column 0|malformed rows 0 (counted, never rendered)|read-capped 0

Exclusive and shared capabilities

This board grades 18 capabilities: 17 exclusive to it and 1 shared with other boards. Shared rows on this page: 1 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 1 + refused 0 (partition 1); undecided = unmapped 0 + unproven 1 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6534.

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395639 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

1. [opa-docs] Open Policy Agent documentation: OPA, a general-purpose policy engine, and Rego, its high-level declarative policy language, with the REST decision API. publisher · read in our library knowledge/fetched/cmp_warden_opa-docs.html · pin h95216e57979fbe650e1719d6387c93928d9185d96230c6f1ee3eee097c5bda33 · accessed 2026-08-18 · vendor-docGrounds: The OPA column: "Policy language (Rego-class, general-purpose)" (OPA 2 = the bar; ours are ORGANS not declarative rules) and "Externalized decision API (central authz query)" (OPA 2; ours is per-daemon in-process) -- the vendor's own statement of both capabilities.
2. [kyverno-docs] Kyverno documentation: Introduction -- a Kubernetes-native policy engine running as an admission controller to validate, mutate, generate and clean up resources and to verify container images. publisher · read in our library knowledge/fetched/cmp_warden_kyverno-docs.html · pin he3626588e8bff553049da4f7fac8cae88d9d09190765bdab349e50250a4d04e3 · accessed 2026-08-18 · vendor-docGrounds: The Kyverno column: "Admission control (gate changes before they land)" (2), "Auto-remediation / mutation of violations" (mutate rules, 2) and "Supply-chain artifact policy (signature verify)" (verifyImages, 2); ours health-gates AFTER staging and ratchets REFUSE but never fix.
3. [checkov-docs] Checkov documentation: What is Checkov? -- static analysis of infrastructure-as-code files for misconfigurations that lead to security or compliance problems, with compliance-framework mappings. publisher · read in our library knowledge/fetched/cmp_warden_checkov-docs.html · pin hb6d36bf974f6d5abdcc75973828ce541ba5176cb7178e798d990fe67c10dbadd · accessed 2026-08-18 · vendor-docGrounds: The Checkov column: "IaC misconfiguration scanning" (Checkov 2 = the bar; our conf files are swept as debt, not scanned) and "Compliance reporting / attestation" (compliance frameworks, 2).
4. [conftest-docs] Conftest documentation: a utility to write tests against structured configuration data (Kubernetes, Terraform, Dockerfiles and more) using OPA Rego policies. publisher · read in our library knowledge/fetched/cmp_warden_conftest-docs.html · pin hf5ea9f23083b8215e71ec6420f751daa3185158f54b93a89447c95823cdd2521 · accessed 2026-08-18 · vendor-docGrounds: The Conftest column and the "Policy testing framework" row (Conftest exists to TEST configs against policy, graded 2 for Conftest); our gates test organs, not policies.
5. [k8s-admission] Kubernetes documentation: Admission Controllers Reference -- validating and mutating admission that intercepts API requests before persistence. publisher · read in our library knowledge/fetched/cmp_devguardrails_k8s-admission.html · pin h901cf891e255ac593d5865bcd24d95ba29279c79f6bb56290c28b8a75183e6fe · accessed 2026-08-18 · vendor-docGrounds: The "Admission control (gate changes before they land)" row: the mechanism Kyverno's admission webhooks plug into, i.e. what gating BEFORE persistence means against our after-staging health gate. Mirror shared with devguardrails.refs.
6. [saltzer75] Saltzer, Schroeder. The Protection of Information in Computer Systems. Proceedings of the IEEE 63(9), 1975 (author-hosted HTML; section I, Basic Principles, carries the design principles including least privilege and the ticket-oriented / capability model). publisher · read in our library knowledge/fetched/cmp_warden_saltzer75-basic.html · pin h6bc487bbfb454e3bade962e769a6e7d87dff0d81c5d2b35b9ffaadc9beb3a61e · accessed 2026-08-18 · published-paperGrounds: The "Capability tokens, attenuate-only, fail-closed verify" row: least privilege and fail-safe defaults are this paper's design principles, and its capability (ticket) as an unforgeable proof of authorization is what X-Nishi-Cap tokens are; the read cap DENIED admin reason 4 is least-privilege proven live.
7. [capmyths03] Miller, Yee, Shapiro. Capability Myths Demolished. Johns Hopkins University SRL technical report SRL2003-02, 2003 (mirror: Agoric papers). publisher · read in our library knowledge/fetched/cmp_devguardrails_capmyths03.pdf · pin hb6a3e04e60d7ef08d32900143f8e93acbdcb62e2b63160b604591d7a021f7f42 · accessed 2026-08-18 · published-paperGrounds: The same capability-token row and "Append-only consent ledger for delegations": the object-capability properties (delegation can only subset, revocation, no confused deputy) that attenuate-only delegation and the consent log implement; the field's OPA authz policies are the partial peer because they are ACL-shaped. Mirror shared with devguardrails.refs.
8. [sigstore-docs] Sigstore documentation: keyless signing with cosign, Fulcio certificate authority and the Rekor transparency log for software artifacts. publisher · read in our library knowledge/fetched/cmp_devguardrails_sigstore-docs.html · pin h008286126a95de87c85a13073dbc269d3c0c62afdbdc244c98eec9d7f2460728 · accessed 2026-08-18 · vendor-docGrounds: The "Supply-chain artifact policy (signature verify)" row (Nishi _ABSENT_): Kyverno verifyImages verifies exactly these Sigstore signatures, so this is the artifact-signing substrate the row's bar assumes. Mirror shared with devguardrails.refs.