Native features registry + risk register + decision/ADL log. Source planes: knowledge/store/featreg-, riskreg-, decreg- (provenanced via nx_store_put hist). Exposure (likelihood x impact) and superseded_by are DERIVED at render, never stored. Query via MCP: nx_info_registry features|risks|decisions|board.
| id | title | status | owner | scope | entry | surface | evidence | note |
|---|---|---|---|---|---|---|---|---|
| FR001 | build-deploy-over-API | live | supervisor | mgmt-api | nx_mgmt POST /api/build+promote+deploy+rollback | /api/docs | deploy_status DEPLOYED-GREEN precedents | never-brick rule-26; run nx_deploy_ready check first |
| FR002 | tool-register-and-cap-mint | live | warden | toolsplane | nx_mgmt POST /api/tools/register + /api/cap/mint | /api | cap_consent.log audit ledger | register+mint LAW pair; update=yes atomic row-replace; callable vs discoverable = separate tiers |
| FR003 | coordination-board | live | pm | coordination | nx_ws_sync kickoff+beat+done+board; nx_ws_cycle standup | /standup | knowledge/status/ws_sync.jrnl | announce-first law; query board BEFORE building |
| FR004 | debt-plane | live | referee | debt | nx_debt add+eat+list; nx_debt_view | /sheriff | debt- plane + hist provenance | eat-debt-first; eat is index-addressed and blind - read row before eating |
| FR005 | frontier-backlog-CPM | live | pm | frontier | nx_frontier_put set+add; nx_frontier_board | /frontier | frontier- store SSOT | 9-col row; float DERIVED never stored; TSV = generated view |
| FR006 | provenanced-info-planes | live | janitor | stores | nx_store_put put+putn+setcol+close+load+hist | - | hist- actor-true provenance | row=[id]+fields; putn ncols incl id max 15; FULL knowledge/store/ prefix or segs land at root |
| FR007 | workflows-as-data | live | conductor | toolsplane | nx_plan_run (planid) | - | planrun- results planes | step output cannot feed next argv - split plans; the same-session fresh-organ driver |
| FR008 | primitives-engine | live | architect | prim | nx_prim_registry+query+gap+synth | - | knowledge/store/prim_registry.json 116 prims | refuse-compose-over-missing; match values not keys |
| FR009 | sovereign-file-ops | live | janitor | fs | nx_fs read+ls windowed max/off; nx_fs_write write+edit | - | byte-parity EXCEED gates | secrets + allowlist + os-namespace deny-by-construction |
| FR010 | sovereign-https-verify | live | engineer | edge | nx_https_get (url) [127.0.0.1:8443] | - | proven our-domain recipes | our domains MUST use connect-override - DSM :443 co-squat coin-flip |
| FR011 | atomic-site-publish | live | sites | publishing | nx_site_publish publish (stage) (site) (dest); nx_pub_desk | /publishing | .prev banked per publish; 143-row registry | clean-url law /X -) X.html; big pages via NXPART marker-chunks |
| FR012 | pre-deploy-reliability-gate | live | supervisor | reliability | nx_deploy_ready check | - | deploy_checks.tsv data-driven manifest | aggregates buildroot-guard BLOCK + api-contract + cron-watch + route-diff; extend by TSV row NO reship |
| FR013 | governance-reconcile | live | supervisor | gov | nx_reconcile_ops run | /governance | reconcile_ops.log hourly :45 cron | exit 3 = honest DRIFT verdict not a crash; verify by log artifact |
| FR014 | atlas-from-god-graph | live | librarian | atlas | nx_eco_graph_build+card+pedigree; nx_atlas_discover+recombine | /compare/atlas | 16.5k nodes 42.8k edges daily beat | cards key by basename .nx; pinned buildroot/runtime build |
| FR015 | ws-history-miner | live | librarian | coordination | nx_ws_miner mine+page | /wsmine | gate 9/9; 43ws 154frames first mine | thresholds are argv data; envelope declared in output |
| FR016 | pm-intake-front-door | live | pm | pm | nx_pm_intake ask+triage+file+list | - | pm_intake.jrnl append-only frames | state derived from frames; composes nx_ask; collision-aware ids v2 |
| FR017 | reversible-evict-janitor | live | janitor | stores | nx_evict evict+restore+selftest | - | retired/ + 6 deny-teeth selftest | additive-only rule-13; elf + protected registries denied by construction |
| FR018 | net-observability | live | supervisor | net | nx_netobs beat+burst+page+bench+verdict | /netobs | VERDICT=GREEN 5/5; p50 4.9ms p99 18.5ms 1315rps | wired clock60s + cron_watch + deploy_ready; TLS certloop debt = F799 |
| FR019 | sheriff-acceptance | live | referee | quality | nx_sheriff | /sheriff | hourly cron SHERIFF-PUBLISHED fires | UAT acceptance; rejected-done-over-debt = the gate working honestly |
| FR020 | native-feature-risk-decision-registries | live | pm | infoplane | nx_info_registry features+risks+decisions+board+page+selftest (cap nonce 1784572125) | /registries | selftest 8/8 GREEN incl T8 supersedes-chain integrity; edge 200 verified | SHIPPED 2026-07-20 ws=info-registries(+adl); planes featreg-(20) riskreg-(12) decreg-(12); F820 D; F821-F823 open |
| id | title | L | I | LxI | status | owner | scope | mitigation | trigger | note |
|---|---|---|---|---|---|---|---|---|---|---|
| RK001 | dsm-443-cosquat-verify-flake | 7 | 6 | 42 | mitigating | engineer | edge | connect-override 127.0.0.1:8443 for ALL our-domain verifies; real fix = edge owns :443 | our-domain fetch returns wrong cert or DSM 404 | D008; GET and POST can land on DIFFERENT :443 instances - retry POSTs |
| RK002 | buildroot-stale-copy-reversion | 5 | 8 | 40 | mitigating | supervisor | build | nx_buildroot_guard live + deploy_checks BLOCK row | fresh organ import fails on old lib copy | recurring nx_seg_store revert class; guard itself nx_syscalls-only = drift-immune |
| RK003 | silent-cron-death | 4 | 7 | 28 | mitigating | supervisor | autonomy | nx_cron_watch dead-man heartbeats vs cron_heartbeats.tsv | heartbeat row stale beyond interval | seq22 team_pulse died unnoticed = the precedent class |
| RK004 | api-route-drop-regression | 4 | 8 | 32 | mitigating | supervisor | mgmt-api | nx_api_contract + nx_route_diff 10min cron + baseline snapshot | route-set shrink vs baseline | /api/promote 404 precedent; mandatory-rollback-in-deploy still open seq229 |
| RK005 | tools-call-64kb-truncation | 8 | 5 | 40 | open | engineer | toolsplane | nx_fs windowed read landed; paged debt list still open seq215 | any big list output silently missing tail rows | hit THIS session on nx_fs ls knowledge/store; prefer targeted queries over full lists |
| RK006 | contended-file-clobber | 6 | 6 | 36 | open | conductor | coordination | claims organ in-flight ws-intel2; route contended edits via intake | two sessions edit clock_jobs / mgmt data / MEMORY.md in same window | MATERIALIZED 5x in one session on MEMORY.md (2026-07-20): collisions during compaction + one MANGLED concatenated line (repaired). Root fix = F825 rail-owned curated block + atomic put verb; seq256 |
| RK007 | mgmt-mcp-transport-flake | 6 | 4 | 24 | mitigating | engineer | mgmt-api | nx_mgmt_client fallback IMMEDIATELY + verify-by-artifact law | nx_mgmt returns text/html or cert error or 5s handshake | proven non-event when fallback used without retry-spinning |
| RK008 | nas-single-point-of-failure | 3 | 9 | 27 | open | operator | infra | F821 FILED (frontier board): mirror knowledge/store planes to second node; swarm nodes exist as candidates | NAS outage = info planes + edge + MCP all down at once | structural single-host; swarm nodes exist but no store replication; rung filed this lane |
| RK009 | cap-secret-rotation-mass-invalidation | 2 | 8 | 16 | accepted | warden | toolsplane | rotation is deliberate-only; re-mint recipe banked; key 0600 NAS-side | -32001 across ALL tools simultaneously | caps die together BY DESIGN on rotate; recovery = re-mint per banked recipe |
| RK010 | memory-vs-ecosystem-knowledge-drift | 7 | 6 | 42 | mitigating | pm | infoplane | featreg- + riskreg- native planes THIS lane + /registries page | session re-derives facts from stale memory files | the detective-work tax the operator named 2026-07-20; registries = the cure |
| RK011 | supervisor-recurring-self-death | 5 | 7 | 35 | mitigating | supervisor | reliability | 1-min watchdog sentinel relaunches on stale heartbeat | supervisor.heartbeat stale over 90s | root cause OPEN - OOM/fork-wedge suspect; watchdog makes it non-fatal only |
| RK012 | stale-laptop-tree-deploy-reversion | 5 | 8 | 40 | mitigating | engineer | build | build-on-NAS SSOT; buildroot = codec SSOT law | mgmt-deploy from stale ~/nxb reverts live routes | double-warned class in doctrine; deploy from buildroot only |
Architecture Decision Log -- query before proposing, so a settled decision is never re-litigated. superseded_by is DERIVED (any decision whose supersedes points here); a dangling supersedes reference fails selftest T8.
| id | status | driver | date | title | context | decision | supersedes | superseded_by | note |
|---|---|---|---|---|---|---|---|---|---|
| DEC001 | accepted | operator | 20260718 | seg-store-over-tsv | flat TSV staging raced and clobbered under multi-session writes | information planes = sovereign seg-store with hist- provenance; TSV demoted to bootstrap staging only | - | - | store-law; better-than-git by construction |
| DEC002 | accepted | operator | 20260706 | api-first-no-shell | shell/WSL is non-sovereign and off-LAN-fragile | all ops route through the sovereign mgmt API + MCP tools; shell only to launch a sovereign ELF | - | - | front-door mandate |
| DEC003 | accepted | operator | 20260101 | never-brick-rule26 | one bricked device kills the brand | any persistent-hardware-write must be read-only/reversible/fail-safe BY CONSTRUCTION and mechanically proven | - | - | absolute brand-critical |
| DEC004 | accepted | operator | 20260720 | nishi-ecosystem-only-reimpls-bench | own reimpls of external systems drift and are non-sovereign as product | own reimpls of external codecs/systems = bench oracles ONLY, never product paths (register/route/wasm = violation) | - | - | tooth F616 warden |
| DEC005 | accepted | architect | 20260717 | exposure-and-float-derived | stored derived values silently drift from their inputs | CPM float and risk exposure are DERIVED at read, never stored | - | - | registries inherit this law |
| DEC006 | accepted | referee | 20260718 | eat-debt-first-mechanized | unpaid debt compounds and hides regressions | scoped sev-gate REFUSES WORK over open in-scope debt; data-driven global floor | - | - | nx_ws_cycle R2a |
| DEC007 | accepted | operator | 20260719 | coordination-announce-board | every session paid a duplication tax re-diagnosing sibling work | announce kickoff + query the board BEFORE building anything | - | - | /standup; the tax this ADL also attacks |
| DEC008 | accepted | warden | 20260717 | register-mint-law-pair | callable != discoverable caused silent tool invisibility | register + cap-mint ALWAYS paired; nx_toolreg_reconcile publishes the schema row for tools/list | - | - | callable vs discoverable = separate tiers |
| DEC009 | accepted | operator | 20260718 | less-than-sota-never-design | by-design/declared-envelope phrasing hid sub-SOTA axes as false positives | every sub-SOTA axis = a FILED frontier rung with an owner; deviations only as MEASURED exceed bets | - | - | nishios=template |
| DEC010 | superseded | engineer | 20260719 | tls-reissue-ed25519-or-p256 | certloop 918-1216ms measured; alg=3 P-384 cert-chain links ~273ms each = ~100x slower than hw OpenSSL | re-issue the nishifamily.com cert chain with Ed25519/P-256 to kill the slow verify | - | DEC011 | WRONG root cause - corrected by DEC011 |
| DEC011 | accepted | tls-crypto | 20260720 | tls-slow-links-are-3rdparty-le-pki | our LEAF is already ECDSA-P256 fast ~24ms; the slow alg=3 P-384 links are Lets Encrypt INTERMEDIATE+ROOT (E5/E6 + ISRG X2) = 3rd-party PKI we CANNOT re-issue; a self-signed ed25519 swap breaks browser trust (why it was reverted) | cannot re-issue 3rd-party links; real levers = request LE RSA certs OR TLS session resumption + our own cert-cache warm path (F799 shipped 67-175ms warm) | DEC010 | - | corrects DEC010; the TLS decision churned 4x seq114/130/134/145 = exactly what an ADL prevents |
| DEC012 | accepted | engineer | 20260720 | buildroot-is-deploy-ssot | mgmt-deploy from a stale ~/nxb mirror reverted live routes | build-on-NAS buildroot only; laptop tree = authoring surface, buildroot = deploy SSOT | - | - | RK012; codec tree same law |
| DEC013 | accepted | librarian | 20260720 | budget-rails-not-hand-curation | the COINDEX block is budget-enforced + auto-evicting but the hand-curated ACTIVE block below it is not; it silently grew past the 24.4KB read limit and dropped its own tail (the laws) while 5 mid-air Edit collisions raced siblings in one session | any shared index/registry read under a size limit must be OWNED BY A RAIL - budgeted, auto-evicting, and mutated by an ATOMIC verb - never by hand-Edit; hand-curation of a contended shared file is a defect class, not a workflow | - | - | seq256 + F825; generalizes DEC001 store-law from data planes to index files |
generated_epoch=1784576014 by nx_info_registry page