schema: 1
updated_at:
owner:
grant_lifecycle_record_reference: grant-matrix.csv

control_host:
  id:
  ordinary_workspace:
  local_recovery_method:
  remote_entry_method:

targets:
  - id:
    purpose:
    tier:
    canonical_name:
    recovery_ipv4:
    connection:
      normal_method: ssh
      normal_alias:
      recovery_method:
      host_key_fingerprint:
      last_verified:
    identity:
      role:
      username:
      credential_reference:
      interactive: false
      grant_id:
    reachability:
      source:
      allowed_ports: []
      explicitly_denied: []
    verification:
      allowed_probe:
      denied_probe:

tools:
  - id:
    purpose:
    interface: null # allowed: cli, api, fixed-action, protected-control-plane, ui
    target:
    documentation_reference:
    allowed_actions: []
    forbidden_actions: []
    native_validator:
    consumer_side_test:
    rollback:
    mutation_execution_artifact:
      absolute_path:
      sha256:
      exact_one_line_invocation:
      complete_dependency_closure: []
      built_in_language_regex_native_checks: []
      built_in_postcondition_consumer_denial_tests: []
      success_only_after_all_checks: true
    credential_reference:
    enforcement_location:

client_adapters:
  - client: null # allowed: Claude Code, Codex, Gemini CLI, other
    client_version:
    model:
    reasoning_effort:
    subscription_class:
    quota_feedback_surface:
    intended_quota_size: null # allowed: tiny, small, medium, large, XL
    approval_mode:
    sandbox_mode:
    writable_roots: []
    network_policy:
    os_privacy_permissions: []
    screen_control_permissions: []
    transcript_capture_method:
    raw_archive_reference:
    model_safe_session_index:
    instruction_or_skill_reference:
    tools_exposed: []
    last_admission_test:

rules:
  - Store credential references, never secret values.
  - A client instruction or skill explains how to call a tool; it does not grant authority.
  - Infrastructure ACLs and target accounts remain authoritative; a fixed action or protected control plane is authoritative only after it actually exists and has been independently reviewed.
  - The grant matrix owns grant lifecycle; this catalog owns connection mechanics and points to a stable grant_id.
  - Revocation changes the real enforcement point first, proves denial, and records the evidence in both views. Editing either record alone changes no authority.
  - Reverify the live target and host key before mutation after a handoff or material change.
  - A low-friction approval mode is permitted only after the same sandbox, target, and denial tests pass in that mode.
  - Every response ends with the exact actor, host or UI, account, path/invocation or wait event, expected result, and resume condition.
