# Source Registry Admin Layer Specification V01

Issue: #269 Build Source Registry Admin Layer v01

Status: architecture and specification only. This note does not implement the admin CLI, mutate Preview or Production source sets, enable any source, change runtime posture, change Cloudflare Access/WAF, change provider or model configuration, change package authority, implement database/vector behavior, implement MCP behavior, or authorize `codex-automerge`.

## Purpose

The source registry administration layer should make steady-state operation of already-approved current/public sources faster, more repeatable, and more auditable than the bootstrap activation ceremony.

Bootstrap activation was intentionally heavy while the current/public retrieval model, Access-authenticated smoke, rollback, source sizing, and receipt patterns were being proven. That ceremony remains appropriate for first-time source activation, risky source classes, new retrieval profiles, and production posture changes.

Steady-state source administration is narrower. It manages source-set state for sources that already have approved source identity, exact origin and path bounds, retrieval profile, owner authorization, smoke requirements, rollback readiness, and package-authority boundaries.

## Explicit Non-Implementation Boundary

This specification records future command contracts and guardrails only.

This pass does not:

- add CLI commands
- execute emergency disable
- execute promotion or rollback
- mutate `AICD_CURRENT_CONTEXT_SOURCE_REGISTRY_JSON`
- change `AICD_CURRENT_CONTEXT_ADAPTER`
- create or modify service tokens
- change Preview source sets
- change Production source sets
- change Cloudflare Access or WAF
- change provider or model configuration
- add arbitrary web search
- add user-provided URL retrieval
- add browser-side provider calls
- add browser-side current-source fetches
- add database, vector, Supabase, D1, R2, Vectorize, or MCP behavior

## Operating Model

The admin layer is a controlled operator surface over existing governance artifacts and external deployment state. It must not become a new source of authority.

| Layer | Role | Authority boundary |
| --- | --- | --- |
| Approved source catalog | Records source identity, approval status, claim boundary, allowed origin and path, freshness, owner metadata, and retrieval profile. | Catalog inclusion is not runtime enablement and is not package authority. |
| Environment source set | Records which approved source IDs are active in Preview or Production. | Environment state is deployment configuration, not package text. |
| Runtime registry payload | Generated allowlisted registry JSON for `allowlisted_public_fetch`. | Payloads must be derived from approved metadata and never accept ad hoc URLs. |
| Smoke orchestration | Runs bounded static, API, and browser-network checks. | Smoke proves behavior. It does not approve source authority. |
| Receipt generation | Records command inputs, source IDs, target environment, guardrail decisions, smoke result, rollback target, and non-changes. | Receipts must redact secret values and must not store production registry values in public text. |

## Term Distinctions

### Bootstrap Activation Ceremony

Bootstrap activation is the heavy governed path used when the source model or runtime behavior is still being proven. It includes issue creation, branch, owner authorization, exact source review, source-specific retrieval profile review when needed, external deployment mutation, Access-authenticated smoke, rollback evidence, validation receipts, context-pack regeneration when repo artifacts change, and PR review.

Use bootstrap activation when a source class is new, the retrieval profile is new, the runtime adapter changes, Cloudflare posture changes, provider/model posture changes, the source has not been smoke-tested in the target environment, or rollback behavior has not been proven for that source.

### Steady-State Source Administration

Steady-state administration is the future operator workflow for already-approved sources. It should use deterministic commands that inspect approved metadata, generate exact registry payloads, apply only authorized environment-scoped changes, run smoke, and produce receipts.

Steady-state administration still requires issue, receipt, smoke, and rollback evidence. It should remove hand-assembled registry payloads, not remove governance.

### Source Approval

Source approval decides whether a source ID is eligible for a specific environment and use boundary. Approval requires exact URL, exact origin, exact path prefix, claim boundary, trust label, freshness label, owner authorization, retrieval profile, allowed use, explicit exclusions, and review date.

Approval does not enable retrieval.

### Source Enablement

Enablement places an already-approved source ID into an environment source set and generated runtime registry payload. Enablement must be target-environment-specific.

Preview enablement does not imply Production enablement. Production enablement requires its own authorization, current baseline smoke, post-change smoke, and rollback readiness.

### Source Promotion

Promotion means using a passing Preview source set as the proposed Production source set. Promotion must compare exact source IDs, source metadata versions, retrieval profiles, smoke receipts, and rollback targets.

Promotion must not bulk-enable unapproved sources, promote candidate-only sources, or promote current/public sources into package authority.

### Source Disablement

Disablement removes one or more source IDs from a target environment source set. Ordinary disablement should be issue-linked, receipt-backed, and smoke-verified.

Disablement should preserve audit history, reason, previous source set, new source set, and rollback posture.

### Emergency Disable

Emergency disable is a restricted path for quickly removing a source from an environment when source availability, redirect behavior, content drift, legal/public-access posture, security posture, or authority boundary becomes unsafe.

Emergency disable may run before ordinary planning completes, but it must still record source ID, target environment, trigger, operator, previous source set, new source set, smoke result, and follow-up issue. Emergency disable does not approve replacement sources.

### Rollback

Rollback restores the last-known-good registry for the target environment. Rollback must be possible without code changes.

The admin layer must capture last-known-good source IDs, registry generation inputs, smoke receipt reference, and redacted deployment reference before any source-set mutation. If post-change smoke fails, rollback is mandatory before additional source operations continue.

### Smoke Validation

Smoke validation proves runtime behavior for the target environment and source set.

Minimum smoke expectations:

- Package only remains default.
- Package + current context remains explicit opt-in.
- `/api/source-grounded-chat` remains the server boundary.
- Direct browser provider calls remain `0`.
- Direct browser current-source calls remain `0`.
- Current/public citations remain separate from package citations.
- Enabled source IDs match the expected environment source set.
- Unknown, unsupported, or out-of-package prompts still fail closed.
- Redirects outside approved origin or path fail closed.
- Cloudflare Access/WAF and provider/model posture are unchanged unless a separate issue explicitly authorizes that change.

### Receipt Generation

Receipts must record what changed, what did not change, what was refused, and how rollback can be executed.

Minimum receipt fields:

- issue or incident reference
- command contract invoked
- dry-run or apply mode
- target environment
- operator
- timestamp
- pre-change source IDs
- proposed source IDs
- post-change source IDs when apply is authorized
- source metadata version or source commit
- retrieval profile IDs
- guardrail pass/fail results
- smoke prompt class and redacted result
- direct browser provider request count
- direct browser current-source request count
- rollback target
- secret-value handling statement
- package-authority non-promotion statement
- Cloudflare Access/WAF non-change statement unless separately authorized
- provider/model non-change statement unless separately authorized
- `codex-automerge` non-application statement

## Future Command Contracts

These are future command contracts only. They are not implemented by this issue.

| Command contract | Intended behavior | Required mode |
| --- | --- | --- |
| `list-approved-sources` | List sources approved for any environment, with source ID, title, approval status, allowed environments, retrieval profile, freshness, and package-authority boundary. | read-only |
| `list-active-sources --env preview|production` | Inspect the active source IDs for one environment without exposing secret values. | read-only |
| `enable-source --env preview --source-id <id>` | Generate and apply a Preview registry payload that includes an approved source ID. | apply only after explicit authorization |
| `disable-source --env preview --source-id <id>` | Remove a source ID from Preview and run Preview smoke. | apply only after explicit authorization |
| `enable-source --env production --source-id <id>` | Generate and apply a Production registry payload only after Production authorization, baseline smoke, and rollback capture. | apply only after explicit authorization |
| `disable-source --env production --source-id <id>` | Remove a source ID from Production and run Production smoke. | apply only after explicit authorization |
| `promote-preview-to-production` | Compare Preview and Production source sets, verify Preview smoke, capture rollback, and propose the Production payload. | dry-run by default |
| `emergency-disable --env preview|production --source-id <id>` | Remove one source ID rapidly, record incident reason, run smoke, and require follow-up issue. | restricted apply |
| `rollback-last-known-good --env preview|production` | Restore the last-known-good registry for the target environment and run smoke. | restricted apply |
| `validate-source-metadata --source-id <id>` | Validate source metadata, approval status, allowed origin, allowed path, retrieval profile, sizing profile, and claim boundary. | read-only |
| `run-environment-smoke --env preview|production` | Run the bounded smoke matrix for the current active source set. | read-only or smoke-only |
| `generate-receipt --env preview|production` | Produce a receipt from command inputs, guardrail decisions, smoke evidence, and rollback reference. | read-only unless paired with authorized apply |

Every apply-capable command must support a dry-run mode that emits the proposed source-set delta, guardrail decisions, smoke plan, and rollback target before mutation.

## Guardrails

The admin layer must refuse:

- unknown source IDs
- candidate-only sources
- sources not approved for the target environment
- sources without owner authorization for the requested action
- wildcard origins
- broad crawling
- root-domain-only fetch scope
- package-authority promotion
- browser-side source fetch
- browser-side provider calls
- arbitrary web search
- user-provided URL retrieval
- missing retrieval profiles
- oversized sources without an explicit source profile
- source-specific profiles that broaden sibling pages
- unbounded redirects
- non-HTTPS source URLs
- credentialed source retrieval
- login-gated sources
- paywalled source retrieval unless separately reviewed and authorized
- secret value logging
- service-token creation or mutation
- Preview mutation from a Production-only command
- Production mutation from a Preview-only command
- apply mode without rollback target capture
- apply mode without a receipt target
- promotion when Preview smoke is missing or failed
- Production enablement when baseline Access-authenticated smoke is missing or failed

Refusals should be receipt-worthy events. A refusal receipt should identify the command contract, source ID, target environment, failed guardrail, and next recommended issue type without exposing secrets.

## Last-Known-Good Registry Model

The last-known-good model should be environment-scoped.

Before any apply-capable source-set change, the future admin layer must capture:

- environment
- active source IDs
- registry payload hash or redacted deployment reference
- source metadata source commit
- retrieval profile IDs
- last passing smoke receipt
- rollback operator or role
- rollback command contract

The repository should not store secret values or production registry payload values. It may store redacted receipt metadata, source IDs, hashes, and deployment references when safe.

## Future Implementation Slices

Issue #269 should remain the parent/meta issue for the admin layer. Implementation should be split into child issues so each slice can carry its own branch, validation, receipt, and rollback discipline.

Recommended child issues:

1. Read-only source admin inspection commands.
2. Source metadata and retrieval-profile validator.
3. Receipt schema and receipt generator for admin actions.
4. Preview enable/disable dry-run payload generator.
5. Preview enable/disable apply executor with rollback capture.
6. Environment smoke orchestration wrapper.
7. Production promotion dry-run planner.
8. Production enable/disable dry-run planner.
9. Production apply executor with Access-authenticated smoke gate.
10. Emergency disable executor and incident receipt path.
11. Last-known-good rollback executor.
12. Admin command documentation and operator runbook.

Do not combine Preview mutation, Production mutation, emergency disable, rollback execution, and smoke orchestration into one implementation PR. Each apply path should be independently reviewable and reversible.

## Read-Only Inspection Child Slice V01

Issue #292 implements the first child slice: read-only source registry admin inspection.

The operator entry point is `scripts/source_registry_admin_inspection.py`.

Supported read-only commands:

- `list-approved-sources`
- `list-active-sources --env preview`
- `list-active-sources --env production`
- `validate-source-metadata`

This child slice reads repo-controlled catalog and receipt artifacts only. It does not read Cloudflare configuration, create service tokens, call Wrangler, call live deployment APIs, inspect browser state, or fetch public source URLs.

Active source-set posture is reported as a repo-documented snapshot, not live environment truth. The current snapshot evidence is recorded in `validation/receipts/AI_Capability_Playbook_CISA_NSA_NCSC_SECURE_AI_PREVIEW_RUNTIME_ACTIVATION_2026-06-26.md`.

The read-only inspection slice does not:

- mutate Preview source sets
- mutate Production source sets
- enable or disable any source
- promote sources
- roll back sources
- execute emergency disable
- change Cloudflare variables or secrets
- change Cloudflare Access or WAF
- change provider or model configuration
- change package authority
- add arbitrary web search
- add user-provided URL retrieval
- add browser-side provider calls
- add browser-side current-source calls
- implement database/vector behavior
- implement MCP behavior
- create autonomous jobs, polling workers, webhook loops, or scheduled loops

## Read-Only Receipt Generation Child Slice V01

Issue #294 implements the next child slice: read-only admin receipt generation.

The operator entry point remains `scripts/source_registry_admin_inspection.py`.

Supported read-only command:

- `generate-receipt`

Supported read-only operation classes:

- `readonly-inspection`
- `admin-planning`
- `metadata-validation`

The receipt generator uses repo-controlled source registry inspection outputs and validation evidence. It reads the v02 source catalog, documented Preview or Production active-posture snapshots, metadata validation results, and local Git metadata. It emits deterministic JSON or Markdown to stdout.

Example JSON receipt command:

```bash
python3 -B scripts/source_registry_admin_inspection.py generate-receipt \
  --operation-class admin-planning \
  --env preview \
  --source-id nist-ssdf-sp-800-218-candidate \
  --timestamp 2026-06-27T00:00:00Z \
  --format json
```

Example Markdown receipt command:

```bash
python3 -B scripts/source_registry_admin_inspection.py generate-receipt \
  --operation-class readonly-inspection \
  --env all \
  --timestamp 2026-06-27T00:00:00Z \
  --format markdown
```

Receipt schema ID:

- `source_registry_admin_receipt_v01`

Receipt fields include:

- timestamp
- operation class
- source ID, when supplied
- target environment
- repo baseline and head
- source catalog posture
- active source-set posture
- metadata validation result
- guardrail checks
- validation commands
- boundary confirmations
- no-mutation confirmation
- operator notes
- dry-run summary

This child slice does not:

- mutate Preview source sets
- mutate Production source sets
- enable or disable any source
- promote sources
- execute rollback
- execute emergency disable
- change Cloudflare variables or secrets
- perform Cloudflare reads or writes
- change Cloudflare Access or WAF
- change provider or model configuration
- change package authority
- add arbitrary web search
- add user-provided URL retrieval
- add browser-side provider calls
- add browser-side current-source calls
- create service tokens
- implement MCP behavior
- implement database/vector behavior
- create autonomous jobs, polling workers, webhook loops, or scheduled loops
- implement admin write behavior

## Preview Dry-Run Planner Child Slice V01

Issue #296 implements the next child slice: read-only Preview source-set dry-run planning.

The operator entry point remains `scripts/source_registry_admin_inspection.py`.

Supported read-only command:

- `plan-preview-source-set`

Supported read-only Preview operations:

- `preview-enable`
- `preview-disable`
- `preview-noop`

The planner uses repo-controlled v02 source catalog metadata and the documented Preview active-posture snapshot only. It does not read Cloudflare state, call Wrangler, call live deployment APIs, inspect browser state, fetch public source URLs, or mutate any source set.

The planner emits deterministic JSON or Markdown to stdout. Its JSON schema ID is:

- `source_registry_admin_preview_dry_run_plan_v01`

Planner output includes:

- issue and parent issue
- timestamp
- operation
- target environment fixed to Preview
- source ID, when supplied
- plan status
- plan classification as no-op, additive, subtractive, or rejected
- before Preview source IDs
- after Preview source IDs
- added source IDs
- removed source IDs
- source metadata, when available
- retrieval profile metadata, when available
- metadata validation result
- documented Preview posture evidence
- guardrail checks
- rejection reasons
- no-mutation confirmation
- linked `source_registry_admin_receipt_v01` admin-planning receipt

Example no-op plan command:

```bash
python3 -B scripts/source_registry_admin_inspection.py plan-preview-source-set \
  --operation preview-noop \
  --timestamp 2026-06-27T00:00:00Z \
  --format json
```

Example subtractive dry-run command:

```bash
python3 -B scripts/source_registry_admin_inspection.py plan-preview-source-set \
  --operation preview-disable \
  --source-id cisa-nsa-ncsc-secure-ai-system-development-guidelines-candidate \
  --timestamp 2026-06-27T00:00:00Z \
  --format json
```

Example rejected activation command:

```bash
python3 -B scripts/source_registry_admin_inspection.py plan-preview-source-set \
  --operation preview-enable \
  --source-id nist-ai-rmf-playbook-candidate \
  --timestamp 2026-06-27T00:00:00Z \
  --format json
```

The rejected activation plan preserves the documented before source set as the after source set and records failed guardrails such as candidate-only activation, missing Preview operation-class approval, and missing retrieval profile for source-set change.

This child slice does not:

- mutate Preview source sets
- mutate Production source sets
- enable or disable any source
- implement Preview apply behavior
- implement Production apply behavior
- promote sources
- execute rollback
- execute emergency disable
- change Cloudflare variables or secrets
- perform Cloudflare reads or writes
- change Cloudflare Access or WAF
- change provider or model configuration
- change package authority
- add arbitrary web search
- add user-provided URL retrieval
- add browser-side provider calls
- add browser-side current-source calls
- create service tokens
- implement MCP behavior
- implement database/vector behavior
- create autonomous jobs, polling workers, webhook loops, or scheduled loops
- implement admin write behavior

## Preview Apply Child Slice V01

Issue #298 implements the next child slice: Preview-only apply artifact generation from an already accepted dry-run plan.

`scripts/source_registry_admin_inspection.py apply-preview-source-set` consumes a generated `source_registry_admin_preview_dry_run_plan_v01` plan and emits:

- `source_registry_admin_preview_apply_v01` apply receipt output
- `source_registry_admin_preview_registry_payload_v01` generated Preview registry payload output
- `source_registry_admin_preview_last_known_good_v01` last-known-good Preview posture capture

This child slice is intentionally repo-controlled artifact generation only. It does not write Cloudflare variables, read Cloudflare state, mutate live Preview configuration, mutate Production configuration, create service tokens, change Cloudflare Access/WAF, change provider/model configuration, change package authority, add browser-side source fetch, add arbitrary web search, add user-provided URL retrieval, implement MCP behavior, implement database/vector behavior, implement autonomous jobs, implement promotion, execute rollback, or execute emergency disable.

The command requires exact operator-supplied inputs:

- dry-run plan path
- `preview-enable` or `preview-disable`
- target source ID
- expected repository head
- expected Preview source IDs
- apply timestamp
- generated Preview registry payload output path
- last-known-good output path
- apply receipt output path

The command refuses to write any output unless the dry-run plan is accepted, the plan schema matches, every dry-run guardrail passes, the explicit operation and source ID match the plan, the expected repository head matches the current and planned baseline, the expected Preview source IDs match the documented Preview posture and the dry-run plan baseline, source metadata validation passes, the source ID is known, retrieval profiles are present, no wildcard or broad crawling scope is present, package authority remains false, browser-side fetch remains false, arbitrary web search remains false, and user-provided URL retrieval remains false.

Last-known-good capture is written before the generated Preview registry payload and receipt. The capture records the before source IDs, source metadata head, posture evidence path, generated before-payload hash, and the explicit statement that rollback execution is not implemented.

Live deployment remains a separate explicit owner-approved step. A generated Preview registry payload from this command is evidence and an operator input candidate, not proof that Cloudflare runtime state changed.

## Preview Smoke Orchestration Child Slice V01

Issue #300 implements the next child slice: Preview smoke orchestration for generated Preview apply artifacts.

`scripts/source_registry_admin_inspection.py smoke-preview-apply-artifacts` consumes explicit repo-controlled artifact paths:

- generated Preview registry payload
- last-known-good Preview capture
- Preview apply receipt

The smoke orchestration schema is:

- `source_registry_admin_preview_smoke_orchestration_v01`

This child slice validates artifact coherence only. It checks that:

- the generated Preview registry payload uses `source_registry_admin_preview_registry_payload_v01`
- the last-known-good capture uses `source_registry_admin_preview_last_known_good_v01`
- the apply receipt uses `source_registry_admin_preview_apply_v01`
- all artifacts target Preview only
- the explicit operation matches the apply receipt
- the explicit source ID matches the apply receipt
- the expected repository head matches the current repo head, apply receipt, and last-known-good metadata head
- the expected before Preview source IDs match the apply receipt and last-known-good capture
- generated payload source IDs match the apply receipt after posture
- last-known-good payload source IDs match the apply receipt before posture
- apply receipt guardrails passed
- no live Cloudflare read or write occurred
- no Preview or Production source-set mutation is performed by the smoke orchestration
- no package authority changed
- #271 remains unstarted

The command emits deterministic JSON or Markdown evidence. Evidence includes artifact hashes, before and after Preview source IDs, guardrail checks, rejection reasons, no-mutation confirmation, and operator-ready smoke contracts.

The smoke contracts are command or checklist contracts only. They cover:

- static route checks
- context-pack and source-registry checks
- Access-authenticated Preview runtime smoke method expectations
- expected source availability observations
- refusal-boundary checks for unsupported prompts

The command does not execute live smoke, perform Cloudflare reads, perform Cloudflare writes, call Wrangler, inspect browser state, create service tokens, mutate Preview, mutate Production, change Cloudflare Access/WAF, change provider/model configuration, change package authority, implement promotion, execute rollback, execute emergency disable, implement MCP behavior, implement database/vector behavior, add arbitrary web search, add user-provided URL retrieval, add browser-side provider calls, add browser-side current-source calls, or create autonomous jobs, polling workers, webhook loops, or scheduled loops.

Example JSON smoke evidence command:

```bash
python3 -B scripts/source_registry_admin_inspection.py smoke-preview-apply-artifacts \
  --registry-payload <repo-path> \
  --last-known-good <repo-path> \
  --apply-receipt <repo-path> \
  --operation preview-disable \
  --source-id cisa-nsa-ncsc-secure-ai-system-development-guidelines-candidate \
  --expected-repo-head <sha> \
  --expected-preview-source-ids <csv> \
  --timestamp 2026-06-27T00:00:00Z \
  --format json
```

Example Markdown smoke evidence command:

```bash
python3 -B scripts/source_registry_admin_inspection.py smoke-preview-apply-artifacts \
  --registry-payload <repo-path> \
  --last-known-good <repo-path> \
  --apply-receipt <repo-path> \
  --operation preview-disable \
  --source-id cisa-nsa-ncsc-secure-ai-system-development-guidelines-candidate \
  --expected-repo-head <sha> \
  --expected-preview-source-ids <csv> \
  --timestamp 2026-06-27T00:00:00Z \
  --format markdown
```

Live Preview deployment and Access-authenticated smoke remain separate explicit owner-approved operations. Smoke-ready evidence from this command is not proof that Cloudflare runtime state changed.

## Production Promotion Dry-Run Child Slice V01

Issue #302 implements the next child slice: Production promotion dry-run planning from validated Preview apply and smoke evidence.

`scripts/source_registry_admin_inspection.py promote-preview-to-production` consumes explicit repo-controlled artifact paths:

- generated Preview registry payload
- last-known-good Preview posture capture
- Preview apply receipt
- Preview smoke evidence

The Production promotion dry-run schema is:

- `source_registry_admin_production_promotion_dry_run_v01`

This child slice validates artifact coherence only. It checks that:

- the generated Preview registry payload uses `source_registry_admin_preview_registry_payload_v01`
- the last-known-good capture uses `source_registry_admin_preview_last_known_good_v01`
- the apply receipt uses `source_registry_admin_preview_apply_v01`
- the Preview smoke evidence uses `source_registry_admin_preview_smoke_orchestration_v01`
- all input artifacts target Preview as the promotion source
- Preview apply guardrails passed
- Preview smoke guardrails passed
- the expected repository head matches the current repo head, apply receipt, last-known-good capture, and smoke evidence
- the expected Production source IDs match the documented Production posture
- generated payload, last-known-good, apply receipt, and smoke evidence hashes and source IDs are internally consistent
- intended Production source IDs are known source IDs
- additive candidate-only sources are refused unless governance explicitly permits Production readiness
- additive sources not approved for Production operation class are refused
- wildcard origins, broad crawling, package-authority promotion, browser-side source fetch, arbitrary web search, user-provided URL retrieval, missing retrieval profiles, and oversized sources without explicit source profiles are refused
- no live Cloudflare read or write occurred
- no Preview or Production source-set mutation occurred
- no package authority changed
- #271 remains unstarted
- Production apply, promotion execution, rollback execution, and emergency disable execution remain unimplemented

The command emits deterministic JSON or Markdown evidence. Evidence includes artifact hashes, before Production source IDs, intended Production source IDs, after Production source IDs, intended additions and removals, plan classification as no-op, additive, subtractive, or rejected, guardrail checks, rejection reasons, and a linked `source_registry_admin_receipt_v01` admin-planning receipt.

If the plan is rejected, after Production source IDs remain the documented before Production posture. Intended source IDs and intended deltas are still reported so operators can see what would have been refused.

The command does not execute promotion, perform Cloudflare reads, perform Cloudflare writes, call Wrangler, inspect browser state, create service tokens, mutate Preview, mutate Production, change Cloudflare Access/WAF, change provider/model configuration, change package authority, implement Production apply, execute rollback, execute emergency disable, implement MCP behavior, implement database/vector behavior, add arbitrary web search, add user-provided URL retrieval, add browser-side provider calls, add browser-side current-source calls, or create autonomous jobs, polling workers, webhook loops, or scheduled loops.

Example JSON Production promotion dry-run command:

```bash
python3 -B scripts/source_registry_admin_inspection.py promote-preview-to-production \
  --registry-payload <repo-path> \
  --last-known-good <repo-path> \
  --apply-receipt <repo-path> \
  --preview-smoke-evidence <repo-path> \
  --expected-repo-head <sha> \
  --expected-production-source-ids <csv> \
  --timestamp 2026-06-27T00:00:00Z \
  --format json
```

Example Markdown Production promotion dry-run command:

```bash
python3 -B scripts/source_registry_admin_inspection.py promote-preview-to-production \
  --registry-payload <repo-path> \
  --last-known-good <repo-path> \
  --apply-receipt <repo-path> \
  --preview-smoke-evidence <repo-path> \
  --expected-repo-head <sha> \
  --expected-production-source-ids <csv> \
  --timestamp 2026-06-27T00:00:00Z \
  --format markdown
```

Production promotion dry-run output is evidence and checklist material for later explicit owner review. It is not proof that Cloudflare runtime state changed and it is not authorization to apply Production configuration.

## Acceptance Boundary For This Specification

This specification is complete when:

- the steady-state admin model is documented
- bootstrap activation and steady-state administration are separated
- command contracts are documented as future-only
- guardrails are explicit
- smoke, receipt, emergency-disable, and rollback expectations are explicit
- #269 is recommended to remain parent/meta
- child implementation slices are recommended
- documentation is discoverable from the product-architecture index
- validation passes
- residue scan is clean
- no source set, runtime posture, Cloudflare Access/WAF, provider/model configuration, package authority, database/vector behavior, MCP behavior, admin write behavior, Preview apply behavior, or source activation changes are made