--- type: directory-identity name: data section: data purpose: Plugin-local data artifacts -- the generated command registry + Brain framework-name snapshot it validates against, the hand-maintained Brain Context Packet schema, and the hand-maintained deployment-surface manifest. founding_phase: 122 phase: 123 milestone: v1.13.0-beta.13 canon_parts: [5, 6, 7, 8] created: 2026-05-12 updated: 2026-09-23 --- # data/ `data/` holds plugin-local data artifacts in two layers: 1. **Generated artifacts** (Phase 122 -- the Workflow Layer): `command-registry.json` and `framework-names.json` are regenerated from source by `scripts/build-command-registry.cjs`. Nothing here is hand-edited. 2. **Hand-maintained artifacts** (Phase 110, Phase 123): `brain-packet-schema.json` is the Brain Context Packet wire schema; `deployment-surfaces.json` is the deployment-surface manifest. Both are validated, not generated. 3. **Dev-time Jev ledger artifacts** (Phase 356, subfolders `jev-policies/` and `jev-labels/`): `jev-policies/command-irreversibility.json` (hand-maintained, navigator-locked) and `jev-labels/command-irreversibility.json` (hand-labeled, navigator-reviewed) are the two dev-time-only inputs; `command-irreversibility-ledger.json` is generated from them by `scripts/build-command-irreversibility-ledger.cjs` and read at runtime by `lib/core/irreversibility-ledger.cjs`. No vendor call happens outside the dev-time builder; the runtime reader is pure local JSON. ## Files in this section | File | Generated by | Purpose | |------|--------------|---------| | `command-registry.json` | `scripts/build-command-registry.cjs` | The framework <-> command registry: `{ ontology_ref, generated_note, commands[], framework_index, curated_chains[] }`. Built from the `frameworks:` / `kind:` / `produces:` / `inputs:` / `autonomous_safe:` keys in every `commands/*.md` frontmatter. The resolver (`lib/workflow/command-resolver.cjs`) reads only this file at runtime. DO NOT hand-edit -- the pre-commit hook and the Feynman runner reject a stale registry. Regenerate: `node scripts/build-command-registry.cjs`. | | `framework-names.json` | `scripts/build-command-registry.cjs --refresh-names` | The committed snapshot of the FEEDS_INTO-linked Brain `:Framework` names (the ~105-name traversable slice, NOT all 748 -- junk like "Amazon" / "Charles Kirschbaum" is excluded) PLUS a small `curated_extras` whitelist of legitimate `:Framework` nodes not yet FEEDS_INTO-linked. The registry validates every `frameworks:` entry against `framework_names UNION curated_extras`; an unresolvable name fails the build. Refresh: `node scripts/build-command-registry.cjs --refresh-names` (a read-only build-time `brain.query`, never at runtime). | | `brain-packet-schema.json` | `scripts/build-brain-packet-schema.cjs` (validated, not generated -- hand-maintained source of truth) | The Brain Context Packet wire format (draft 2020-12 JSON Schema): `$defs` per all 12 closed-vocabulary Brain jobs (each carrying an `in` and an `out` shape), shared `$defs` for `LocalGraphSummary` / `BankedOpportunities` / the `privacy_mode` enum / the `packet_version` const / the `origin` enum / the 4 safe-projection shapes, `additionalProperties: false` on every object node (the Canon Part 8 leak-prevention teeth). `lib/core/brain-client.cjs::sendPacket` (Phase 110-03) compiles it once and validates every outbound packet and every Brain response against the job's `in`/`out`. DO NOT hand-edit carelessly -- the pre-commit hook (Phase 110-04) and the Feynman runner reject a malformed schema / a job missing `in`+`out` / an unknown-job `$def` / a missing `additionalProperties: false`. Re-validate: `node scripts/build-brain-packet-schema.cjs --check`. Bound to Phase 110; canon parts 8 + 9. | | `deployment-surfaces.json` | hand-maintained (NOT generated, NO `--check` tripwire) | The static deployment-surface manifest read by `scripts/session-start` (for the on-version-change owned-surface reconcile) and `scripts/doctor.cjs` class J (Plan 123-03; for drift flagging). Schema (`{ schema_version, surfaces:[{id, path, owner, topology_scope, check_kind, expected, reconcile, remediation, path_within_file?}, ...] }`) is the D-07 contract from `.planning/phases/123-install-lifecycle-harness/123-CONTEXT.md`, extended in Plan 123-03 with an optional `path_within_file` (dot-path) field that tells the `check_kind: exact-value` reader to JSON-parse `path` and compare the value at `path_within_file` against `expected` rather than substring-matching the whole file. Six entries cover: the statusline dispatch shim, the `settings.json` statusLine command (uses `path_within_file: "statusLine.command"` per the live-dev-box bug -- whole-file substring match was producing `ok:false` against a healthy settings.json), `~/.mindrian-last-version`, the install-state record (self, observed-only), the plugin-bin `$PATH` entry (observed-only), and the dev-clone pre-commit hook (`topology_scope: dev-clone` -- skipped on a user box). Paths use literal `$HOME` / `` / `` tokens (no absolute paths). New surface = one JSON entry, no code change. Bound to Phase 123 plans 02+03 (HARNESS-123-06 + HARNESS-123-08); canon parts 5 + 6. | | `jev-policies/command-irreversibility.json` | hand-maintained, navigator-locked (NOT generated) | The written irreversibility policy that Phase 356's builder sends byte-identical with every dev-time Noul call (D-01): `{ policy_id, version, status, instructions, criteria: {true, false}, boundary_cases[] }`. `version: 3`, `status: "locked"` (D-22: `instructions` opens with one strategy sentence -- the navigator's attention is the scarce resource -- before the tactical rubric; every `boundary_cases` entry is tagged with the strategic reason it serves). One file per dev-time Jev ledger in this folder, shared with Phase 357 and 354-17 (D-01), NOT the runtime `data/harness-policies/` gate policies (different schema, different purpose). `policy_hash` (SHA-256 of the file bytes) is recorded in `command-irreversibility-ledger.json` and enforced byte-for-byte by the `material_step_ledger` egress guard's `must_equal_file` check (`scripts/jev-devtime-client.cjs`). DO NOT hand-edit without a navigator ruling -- the policy is locked. | | `jev-labels/command-irreversibility.json` | hand-labeled answer key, navigator-reviewed (NOT generated) | The 113-row answer key Phase 356's builder sets its threshold T against (D-15: zero misses on every labeled-true row): `{ schema, labels_for, registry_hash, reviewed_by, reviewed_at, method, rows[], appeal_rulings }`. 99 rows by two-model blind agreement, 14 by direct navigator arbitration (D-20); the report must state plainly this is model-built and human-arbitrated, not fully human-labeled. `appeal_rulings` records any D-14 chain-run-false-alarm ruling (none needed this build; see `356-APPEAL-SHEET.md`). DO NOT hand-edit -- relabeling a row requires a new navigator ruling. | | `command-irreversibility-ledger.json` | `scripts/build-command-irreversibility-ledger.cjs` (dev-time only, NEVER at runtime) | The generated per-command irreversibility scores: `{ schema, built_at, build_mode, jev_model, policy_hash, answer_key_hash, registry_hash, text_hash_basis, threshold, threshold_set_by, margin, labeled_irreversible, false_alarm_count, false_alarms[], jev_calls, input_tokens, output_tokens, estimated_cost_usd, cost_basis, entries[] }`. Read locally and add-only by `lib/core/irreversibility-ledger.cjs` through `forcesIrreversible` (reached from `chain-executor.cjs`'s `isIrreversibleStep` only after both older signals return nothing -- it can force a step material, never force one safe). `--check` is key-free (no vendor call) and exits 0 with WARNs on staleness. Regenerate only with the navigator's authorization (Checkpoint D) and only from `--from-raw` or a fresh live Jev call; never hand-edit. | | `jev-policies/card-fire-replay.json` | hand-maintained, dev-time only (NOT generated) | The three Noul policies Phase 357's labeler (`scripts/label-card-fire-replay.cjs`) states in every request: `is_fork`, `already_answered`, `relevant`, each independent, never compared to each other (D-12). Shape: `{ policy_set, version, phase, used_by, noul_mapping, policies: [{ policy_id, version, instructions, criteria: {true, false}, boundary_cases[] }] }`. Byte equality against every outgoing payload is enforced by the `card_fire_replay` egress profile's `must_equal_file` check (`scripts/jev-devtime-client.cjs`); every `boundary_cases` string and every `instructions.rule` must also be a string literally present in this file (`question_strings_from_file_key`). Never read at runtime. Bound to Phase 357; canon parts 8 and 11. DO NOT hand-edit without a navigator ruling. | | `jev-policies/fork359-moonshot.json` | hand-maintained, dev-time only (NOT generated) | The two Score policies Phase 359's dev-only scorer (`scripts/score-moonshots-359.cjs`) states in every request: `relevant_to_context`, `radical_departure`, each independent, never compared to each other (N-3). Shape: `{ policy_set, version, phase, used_by, policies: [{ policy_id, version, instructions, levels[5], boundary_cases[] }] }`; `levels` describe situations, not degrees, per Jev's Score contract. Byte equality against every outgoing payload is enforced by the `fork359_moonshot` egress profile's `must_equal_file` check (`scripts/jev-devtime-client.cjs`); the profile omits `question_strings_from_file_key` (Score criteria is an array, not a Noul `{true, false}` object), so every rule, level and boundary string is instead copied verbatim from this file by the scorer's builder and asserted deep-equal by its own test. Never read at runtime. Bound to Phase 359; canon parts 8 and 12. DO NOT hand-edit without a navigator ruling. | ## Canon Part 8 boundary (plugin-local, validated AGAINST the Brain, never written back) `command-registry.json` is plugin-local product surface -- commands NEVER enter the Brain. `framework-names.json` is the one Brain-derived artifact in this loop, and it carries only generic `:Framework` node names (a methodology handle, never user content). The `--refresh-names` query (`MATCH (f:Framework) WHERE (f)-[:FEEDS_INTO]-() RETURN f.name`) is read-only; there is no write Cypher anywhere in the generator, and nothing here is queried at runtime. ## Decision #15 compliance Per `CLAUDE.md` Decision #15, every directory carries a ROOM.md identity file. `data/` was founded by Phase 122 and extended by Phase 110 (`brain-packet-schema.json`), Phase 123 (`deployment-surfaces.json`) and Phase 356 (`jev-policies/command-irreversibility.json`, `jev-labels/command-irreversibility.json`, `command-irreversibility-ledger.json`); subsequent additions update the "Files in this section" table. No MINTO.md required at this level -- the `.room-root` cascade scope is `room/`, not `data/`. ## Cross-references - Generator: `scripts/build-command-registry.cjs` - Schema validator (Phase 110-01): `scripts/build-brain-packet-schema.cjs` - Resolver (runtime consumer): `lib/workflow/command-resolver.cjs` (Phase 122-03) - Manifest walker (runtime consumer): `scripts/session-start` (Phase 123-02 -- on-version-change reconcile); `scripts/doctor.cjs` class J (Phase 123-03 -- drift flagging) - Frontmatter contract: `docs/COMMAND-FRONTMATTER.md` - Spec: `.planning/WORKFLOW-LAYER-SPEC.md` - Canon: `docs/MINDRIAN-CANON.md` Parts 5, 6, 7, 8 (and Part 9 via `brain-packet-schema.json`) - Sibling identity reference: `lib/workflow/ROOM.md` (Phase 122)