feat(integration): add CWL capability catalogue v1

[seonghobae]

Dependency

Stacked on #1013. Merge #1013 first, then retarget or replay this PR from the resulting protected main and regenerate exact-head review/check evidence. Do not merge this PR ahead of its envelope dependency.

Why

The organization-level event and command envelopes define transport semantics, but buyers and product teams still need an executable answer to five questions for every CWL integration:

1. Which repository owns the product responsibility?
2. Which service owns the authoritative fact?
3. What versioned contract and data-flow class are permitted?
4. What maturity has actually been demonstrated?
5. What should the customer or operator do on success, rejection, timeout, duplicate, and rollback?

Without a machine-readable responsibility ledger, repositories can duplicate truth, drift toward direct SQL, copy credentials, broadcast raw PII, or present planned architecture as deployed behavior.

What changed

• Adds closed JSON Schema Draft 2020-12 contracts for service capabilities and purpose-bound provider/consumer relationships.
• Adds a conservative 24-repository CWL capability catalogue covering .github, naruon, Orgmetra, keyverse, contextual-orchestrator, psychometrics-commons, fast-mlsirm, TEPP, semantic-data-portal, OriginWeave, newsdom-api, RankWeave, ThreadWeave, EgressWeave, LineageWeave, inkspan, clearfolio, mhtml-etl-gateway, mightyETL, pg-erd-cloud, EmbedRelay, appguardrail, life-os, and bandscope.
• Adds modular stdlib-only validation for strict UTF-8/JSON, bounded input, path and symlink safety, unique identity, controlled maturity, versioned contracts, authoritative ownership, and relationship graph integrity.
• Fails closed on direct cross-repository SQL, credential copying, raw PII broadcast, inferred-lineage authoritative writes, business data in build-control relationships, restricted data without purpose-bound flow, and maturity beyond either endpoint.
• Preserves authorized PII workflows through opaque references, authoritative-service lookup, workload identity or delegated access, purpose-bound authorization, field-level protection, retention, revocation, and audit rather than workflow-breaking blanket masking.
• Adds customer-next-action guidance, a federated responsibility map, closed-loop enterprise value chain, ADR, CSAP/SOC 2 engineering-readiness mapping, APA 7 doctoring, and [Unreleased] changelog evidence.
• Adds an exact-head, read-only, immutable-pin quality workflow with no model credential, OIDC permission, repository write authority, network lookup, or production dependency.

TDD and repair evidence

• RED contract commit: 8209109760272a3793365a547d3b9fcf2cf7bb6b
• GREEN implementation commit: 4fa3d6b131bdab7c5ca45706ba52b149ea3c7c67
• Exact-head test-collection repair: ffbb486589475994469e3f9132e46310b970826d

The first hosted run exposed a real direct-node pytest collection defect: the catalogue helper module was not importable on the GitHub runner. The current head adds a test-scoped deterministic loader without changing production code or global import paths. The second exact-head hosted run completed successfully.

Exact-head hosted validation

Current head: ffbb486589475994469e3f9132e46310b970826d

Workflow run: 31887597216

15 tests passed
359 production statements: 100%
136 production branches: 100%
Catalogue CLI positive validation: passed
Python compileall: passed
Exact source-head checkout: passed
Read-only token permissions: passed

The reconstructed local validation also found no missing production module/class/function docstrings and validated the Draft 2020-12 metaschemas plus positive service and catalogue instances. Hosted exact-head evidence remains authoritative; this description does not treat local, queued, stale, or predecessor-head evidence as merge success.

Product boundary

Central .github owns organization vocabulary, catalogue schemas, the reviewed catalogue, reusable validation, and compatibility guidance. Leaf repositories continue to own domain semantics, operational databases, migrations, runtime adapters, release artifacts, and provider/consumer acceptance evidence. The catalogue is an architecture and deployment ledger, not a global runtime authority.

Rollout

1. Integrate feat(integration): establish CWL ecosystem contract v1 #1013 through normal protected-branch policy.
2. Retarget or cleanly replay this stack from protected main.
3. Re-run all exact-head tests, security/SAST/SBOM/provenance checks, and independent review.
4. Add one leaf capability manifest and one real provider/consumer pair at a time.
5. Promote maturity only after both repositories have exact-version contract, authorization, idempotency, degraded-mode, provenance, and rollback evidence.

Refs #1014

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 0eb18ef5-ba86-471b-b416-b0e39a96a691

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}