# AEGIS Repository — v1.0

- **Status:** FROZEN
- **Date:** 2026-07-10
- **Freeze authority:** Architecture Guardian (acting on directive to materialize ARCH-60 §4)
- **Depends on:** CLAUDE.md (Constitution), docs/architecture/60-reference-architecture-review.md §4
- **Approved by:** *(signatures collected at freeze ceremony)*

---

## 1. What is frozen

The repository structure — every directory, workspace configuration, contract stub, config directory, CI workflow, verification-infrastructure scaffolding, and governance artifact — is the physical manifestation of the frozen architecture. This structure is now v1.0.

- **112 directories** matching ARCH-60 §4 exactly.
- **248 files** of scaffolding (READMEs, workspace configs, contract .proto stubs, ADR template, ADR-0001, CODEOWNERS, CI workflow stubs, seeded Debt Register, verification matrix/registry schemas, release checklist, redaction/detection/config/tools READMEs, deployment topology READMEs).
- **60 architecture documents** live under `docs/architecture/` — the canonical reference.
- **1 ADR** (`ADR-0001-adopt-adr-process.md`) — the seed that authorizes the ADR process itself.

## 2. What is NOT frozen

Implementation *content* is not frozen. The structure is the container; production code lands here per the confirmed implementation order (ARCH-60 §2 R-9).

**No production logic exists yet.** Every `src/lib.rs`, `src/index.ts`, and `.proto` file contains only:
- The docstring linking to the owning ARCH-* document.
- Architectural notes (Golden Invariants, rules, obligations).
- No implementation.

This is intentional. The first line of production code lands with the Security Kernel IRA sign-off.

## 3. Repository as security boundary

Per the user's directive: **the repository structure is a security boundary.**

Structural rules enforced by CI + CODEOWNERS:
- `docs/architecture/**` is frozen. Modifications require an ADR + Consistency Checker C-1..C-9 pass.
- `docs/adr/**` is append-only for Approved ADRs; edits require new versions (ARCH-35 D-35-2).
- `config/**` is signed configuration — ceremony-controlled per class (ARCH-22).
- `tests/golden/**` is Golden-protected — special approver + Auditor visibility (ARCH-28 §4).
- `contracts/**` requires an ADR for additions (ARCH-35 §3).
- `.github/workflows/**` is signed configuration — Owner + Auditor sign-off on changes.
- `crates/kernel/**` and `crates/crypto/**` are two-approver security-critical paths (ARCH-19 §6.4).

## 4. Post-freeze Conditionals (from ARCH-60 §3)

The four Conditionals from the Reference Architecture Review remain active engineering work items, auditor-visible until closed:

1. **ADR retrofit** — Platform Architect, 30-day SLO. Converts ~140 embedded `D-*` Decisions from ARCH-01..ARCH-57 into numbered ADRs alongside `ADR-0001`.
2. **Verification Matrix population** — per-subsystem IRA populates `docs/verification/matrix.yaml` rows.
3. **Operational runbook authoring** — per-subsystem during ARCH-59 Phase 5.
4. **Repository structure adoption** — Implementation Owner formally acknowledges this v1.0 freeze and commits to preserving it.

## 5. What happens next

Implementation of the **Security Kernel** may begin per the confirmed priority order:

1. Security Kernel
2. Identity Engine
3. Capability Broker (Kernel sub-module)
4. Policy Engine
5. Evidence Engine
6. Audit Engine
7. Runtime Risk Engine
8. Verification Infrastructure
9. Recovery Domain
10. AI Safety Layer
11. AI Engine

The Security Kernel IRA (`docs/ira/security-kernel.md`) is the next artifact. It must satisfy all six CPs (ARCH-53 §2) and specify all six boundaries (ARCH-53 §3) before a single line of production code lands.

## 6. Verification of the freeze

- Directory structure conforms to ARCH-60 §4: **verified.**
- Workspace configurations (Cargo.toml, pnpm-workspace.yaml, package.json, tsconfig.base.json) present: **verified.**
- ADR process seeded (ADR-0001 + TEMPLATE): **verified.**
- Debt Register seeded from ARCH-29 §4: **verified.**
- Verification Matrix schema present (unpopulated by design): **verified.**
- Assurance Claim Registry schema present (unpopulated by design): **verified.**
- Release Certification Checklist scaffolded: **verified.**
- CODEOWNERS in place: **verified.**
- CI + SBOM + SLSA + signing + air-gap + redaction canary + verifier conformance workflows scaffolded: **verified.**
- No production logic present: **verified** — this is the intended state.

## 7. Freeze signature block

To be completed at freeze ceremony:

- **Architecture Guardian:** __________________
- **Platform Architect:** __________________
- **Owner:** __________________
- **Auditor:** __________________
- **Implementation Owner:** __________________
- **Freeze approved on:** __________________
- **Ceremony hash:** __________________
- **Transparency-log entry:** __________________ *(published per Q-14-1)*

## 8. Change log

- **v1.0 (2026-07-10)** — Initial freeze. Repository materialized from ARCH-60 §4; awaiting ceremony sign-off.