README.md

SecureToolKit Documentation

This index separates public orientation, normative security contracts, implementation programs, operational evidence, and historical records. A document's title or location does not grant authority.

How to resolve conflicts

Use this precedence order and fail closed:

1. Frozen protocol specifications and accepted ADRs, including explicit supersession and accepted amendments.
2. Accepted phase architecture and implementation contracts.
3. Current phase decisions and security-remediation contracts.
4. Root security and API documents.
5. Conformance specifications and accepted governance records.
6. Migration guides and examples.
7. Operational evidence, release notes, reviews, and historical plans.

A contradiction between normative records is a release defect. It is not permission to select the more permissive interpretation.

Start here

• Project overview
• Host responsibility overview
• FAQ
• Public roadmap
• Contributing
• Security policy
• Support

Core security and architecture

• Vision
• Architecture
• Security model
• Threat model
• Security invariants
• Public API design
• Public API inventory
• ADR index

Frozen Phase 1–6 protocol

• SecureToolKit Authorization Protocol
• Phase 1 decisions
• Phase 2 decisions
• Phase 3 decisions
• Phase 4 decisions
• Phase 5 decisions
• Phase 6 decisions
• Invariant test matrix through Phase 6

Phase 7 human confirmation

• Accepted architecture
• Architecture decisions
• ADR-0042: Human Confirmation Semantics
• Implementation contract
• Test matrix
• Conformance requirements
• Implementation roadmap
• Implementation slices
• Acceptance gates
• S01 structural-checker erratum

Planning documents retain the status metadata of the revision in which they were accepted. Their “implementation not started” wording is historical metadata, not a statement about the current source tree.

Conformance and interoperability

• Conformance Suite specification
• Interoperability specification
• Conformance report format

Candidate corpus material is not an approved conformance result. Publication status must be determined from the exact corpus identity, its authority record, and its immutable review evidence.

Integration and migration

• Examples
• Pre-1.0 migration index
• RC0.1 migration
• RC0.2 migration
• RC0.1 security remediation
• RC0.2 security remediation

Examples are explanatory and non-authoritative. They do not perform Consumption or Execution.

Release and review history

• RC0_FINAL_1 release evidence
• RC0 security review archive
• Historical Phase 1–6 roadmap

Operational evidence records results for exact historical commits and toolchains. Test counts and platform claims do not automatically apply to the current checkout.

Repository documentation rules

• Keep one H1 heading per document.
• State whether a release, corpus, review, or result is approved, candidate, historical, or informational.
• Never use a candidate result as approved evidence.
• Preserve frozen hashes and explicit supersession records.
• Prefer links from this index over duplicating normative text.
• Keep secrets, customer data, raw prompts, and sensitive arguments out of documentation and evidence.