chore: add CASTUO V1.0 conformance metadata

.github/workflows/castuo-repository-conformance.yml

@@ -0,0 +1,50 @@
+name: CASTUO repository conformance
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  conformance:
+    name: Validate against CASTUO-REPOSITORY-STANDARD-V1.0
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout Cast-o
+        uses: actions/checkout@v4
+
+      - name: Require canonical control-plane token
+        env:
+          CASTUO_AUDIT_TOKEN: ${{ secrets.CASTUO_AUDIT_TOKEN }}
+        run: |
+          if [ -z "$CASTUO_AUDIT_TOKEN" ]; then
+            echo "::error::CASTUO_AUDIT_TOKEN is required to read the private castuo-evolution control plane."
+            exit 1
+          fi
+
+      - name: Checkout canonical standard
+        uses: actions/checkout@v4
+        with:
+          repository: Traky12/castuo-evolution
+          token: ${{ secrets.CASTUO_AUDIT_TOKEN }}
+          path: .castuo-standard
+          ref: main
+          persist-credentials: false
+
+      - name: Run canonical validator adapter
+        run: |
+          python3 scripts/run_castuo_repository_conformance.py \
+            --standard-root .castuo-standard \
+            --repository-root . \
+            --output artifacts/castuo-repository-conformance.json
+
+      - name: Upload conformance report
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: castuo-repository-conformance
+          path: artifacts/castuo-repository-conformance.json

.github/workflows/castuo-v1-repository-conformance.yml

@@ -0,0 +1,58 @@
+name: CASTUO V1 repository conformance
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  repository-conformance:
+    name: repository-conformance-local-scope
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate declared CASTUO V1 metadata
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -f repository.yaml
+          test -f governance/castuo-standard-reference.yaml
+          grep -q 'metadata_source: CASTUO-REPOSITORY-STANDARD-V1.0' repository.yaml
+          grep -q 'current_state:' repository.yaml
+          grep -q 'evidence_state:' repository.yaml
+          grep -q 'production_claim: NOT_CLAIMED' repository.yaml
+          grep -q 'promotion_state: PROMOTION_BLOCKED' repository.yaml
+          grep -q 'standard_id: CASTUO-REPOSITORY-STANDARD-V1.0' governance/castuo-standard-reference.yaml
+          grep -q 'reference_mode: CANONICAL_REFERENCE_NOT_COPY' governance/castuo-standard-reference.yaml
+          grep -q 'production: NOT_CLAIMED' governance/castuo-standard-reference.yaml
+          grep -q 'promotion: BLOCKED_UNTIL_LOCAL_SCOPE_EVIDENCE' governance/castuo-standard-reference.yaml
+
+      - name: Emit bounded conformance result
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p artifacts/castuo-conformance
+          cat > artifacts/castuo-conformance/result.json <<'JSON'
+          {
+            "standard": "CASTUO-REPOSITORY-STANDARD-V1.0",
+            "scope": "repository metadata and canonical reference only",
+            "status": "PASS",
+            "production": "NOT_CLAIMED",
+            "promotion": "BLOCKED_UNTIL_LOCAL_SCOPE_EVIDENCE",
+            "identity_is_evidence": false,
+            "local_conformance_is_remote_truth": false
+          }
+          JSON
+
+      - name: Upload bounded conformance artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: castuo-v1-repository-conformance
+          path: artifacts/castuo-conformance/result.json

CHANGELOG.md

@@ -1,11 +1,34 @@
 # CHANGELOG
 
-## [Unreleased] - 2026-08-01
+## [Unreleased] - 2026-08-17
 
-- Merge fe9a1449e46f3e84ce0fe013375dd0b7938ba43c into e067bde4d081caf85c3af10b51160abef24c466a (0ba736c)
-- Revise README for Cast-o framework details (fe9a144)
+- Merge f5a99607eb78863cdf366032b028fb4a7183bb8a into e3aabfcdc870d3166109a22287e2fcf325306632 (84d54a8)
+- docs: connect commercial readiness path (f5a9960)
+- docs: actualizar changelog preview del PR (0c4cbe1)
+- Merge d2397981c903b1259b3fd5e3470d0fa4ff976664 into e3aabfcdc870d3166109a22287e2fcf325306632 (957b863)
+- ci: add bounded CASTUO V1 conformance check (d239798)
+- docs: actualizar changelog preview del PR (3a42bbd)
+- Merge 2805233bb48191b7e695641d51321b99e76cd40e into e3aabfcdc870d3166109a22287e2fcf325306632 (d77c869)
+- chore: sync CASTUO V1.0 repository reference (2805233)
+- docs: actualizar changelog preview del PR (234517f)
+- Merge 1d18345a703c5119059eea814ba3cf966df428c4 into e3aabfcdc870d3166109a22287e2fcf325306632 (d30b9d2)
+- docs: add governed CASTUO public surface (1d18345)
+- docs: add CASTUO public surface boundary (265c395)
+- docs: actualizar changelog preview del PR (ea6d788)
+- Merge 772ab281c915bfe5689cd1ddb8c7ca095389d040 into e3aabfcdc870d3166109a22287e2fcf325306632 (5b3d366)
+- ci: fail clearly when audit token is missing (772ab28)
+- docs: actualizar changelog preview del PR (12017db)
+- Merge 4f135b9a336b7ce0688da3d0426bfffc57a09f7a into e3aabfcdc870d3166109a22287e2fcf325306632 (3bd5583)
+- ci: authenticate canonical control plane checkout (4f135b9)
+- docs: actualizar changelog preview del PR (b79974c)
+- Merge f9aaa398e034e9dc4ca41a0c85e605b67ba3d3a5 into e3aabfcdc870d3166109a22287e2fcf325306632 (649b0f9)
+- chore: add CASTUO V1.0 conformance metadata (f9aaa39)
+- feat: consume canonical castuo repository conformance (cf3d311)
+- docs: add negative assurance boundary (e3aabfc)
+- docs: add private cloud evidence boundary (4d0c0f7)
+- ci: align documentation and validation contracts (6c9e233)
+- ci: make hardening and Python validation CI-safe (0c86512)
+- chore: apply architecture governance and security baseline (5ccf164)
+- docs: rewrite README to align with ecosystem contract and evidence-first principles (8484ced)
+- Revise README for Cast-o framework details (#11) (f4ea214)
 - Create SECURITY.md for security policy and reporting (#5) (e067bde)
-- docs: actualizar resumen visual automatizado (cf1b175)
-- Add GitHub Actions workflow for Python package with Conda (d1b6e5c)
-- docs: actualizar quick reference automatizado (c4309d4)
-- Initial commit (67cc765)

Makefile

@@ -305,3 +305,12 @@ runbook-prepilot:
 security-hybrid-check:
 	@echo "[INFO] Ejecutando verificacion de seguridad hibrida (WAF/IDS/K8s)..."
 	bash scripts/security-hybrid-check.sh
+
+# CASTUO-REPOSITORY-STANDARD-V1.0
+castuo-conformance:
+	@python3 scripts/run_castuo_repository_conformance.py \
+		--standard-root $${CASTUO_STANDARD_ROOT:-../castuo-evolution} \
+		--repository-root . \
+		--output artifacts/castuo-repository-conformance.json
+
+.PHONY: castuo-conformance

README.md

@@ -70,6 +70,10 @@ pytest tests/ -v
 ## 6. Navigation
 [← Ecosystem Profile](https://github.com/Traky12) | [→ Core Platform](https://github.com/Traky12/Castuo-system) | [→ Assurance](https://github.com/Traky12/goldfish) | [→ Architecture Docs](docs/)
 
+### Commercial-readiness connection
+
+Cast-o supplies validation and provenance checks for the bounded product and pilot path. The canonical control-plane references are the [product scope](https://github.com/Traky12/castuo-evolution/blob/chore/refresh-integration-status-20260816/docs/product/CASTUO_EVIDENCE_READY_FIELD_OPERATIONS.md), [PILOT-001 scope](https://github.com/Traky12/castuo-evolution/blob/chore/refresh-integration-status-20260816/docs/pilot/PILOT-001_PUBLIC_SCOPE.md) and [commercial gates](https://github.com/Traky12/castuo-evolution/blob/chore/refresh-integration-status-20260816/docs/commercial/COMMERCIAL_READINESS_GATES_G0_G8.md). Cast-o test results support their declared scope; they do not establish a customer, contract, invoice, payment or production operation.
+
 ---
 
 ## 🌐 Connect
@@ -99,3 +103,13 @@ A passing local test proves only the declared test scope. It does not prove fede
 This repository is part of the CASTÚO-SYSTEM private-cloud target architecture. Its repository scope does not by itself prove cloud provisioning, DNS, production operation, customer traction, financing, certification or independent validation. The service identity is a governed target boundary until a deployment record, access control, health check, observability, backup, restore, rollback, owner and dated Evidence Center record are published.
 
 The public state model is `DOCUMENTED` → `IMPLEMENTED_LOCAL` → `TESTED` → `VALIDATED` → `OPERATIONAL`. OpenClaw and n8n, where referenced, are optional compatibility adapters and not the sovereign governance control plane.\n
+
+<!-- CASTUO:PUBLIC-SURFACE -->
+## CASTÚO integration boundary
+
+This repository exposes only a bounded public integration surface. Its role, current state and claims are subordinate to the `Traky12/castuo-evolution` control plane.
+
+This repository does not by itself claim production operation, certification, independent validation, customer contracts, revenue, autonomous authority, global federation or legal compliance. Do not publish secrets, credentials, private endpoints, customer data, private evidence or unpublished security findings.
+
+See [`docs/CASTUO_PUBLIC_SURFACE.md`](docs/CASTUO_PUBLIC_SURFACE.md) for the public boundary. `Claim != Evidence`; `CURRENT != TARGET`; promotion requires control-plane authorization.
+<!-- CASTUO:PUBLIC-SURFACE-END -->

artifacts/castuo-repository-conformance.json

@@ -0,0 +1,11 @@
+{
+  "standard": "CASTUO-REPOSITORY-STANDARD-V1.0",
+  "validator_source": "../castuo-evolution/scripts/validate_repository_conformance.py",
+  "repository_root": "/home/ubuntu/Cast-o",
+  "status": "BLOCKED",
+  "findings": [
+    "BLOCKED:repository.yaml_missing"
+  ],
+  "generated_at": "2026-08-16T16:34:21.211678+00:00",
+  "semantic_owner": "castuo-evolution"
+}

docs/CASTUO_PUBLIC_SURFACE.md

@@ -0,0 +1,23 @@
+# CASTÚO Public Surface Boundary
+
+This repository is a bounded public surface of CASTÚO. Its role and any public state are subordinate to the `castuo-evolution` control plane.
+
+## Publicly allowed
+
+The repository may expose its bounded role, documented capability, reproducibility instructions that require no secrets, approved public evidence and a claims boundary.
+
+## Not claimed
+
+This repository does not by itself prove production operation, certification, independent validation, continuous operation, customer contracts, revenue, field KPIs, autonomous authority, global federation or legal compliance.
+
+## Security boundary
+
+Do not publish secrets, credentials, private endpoints, customer data, personal data, private evidence, internal diagnostics or unpublished security findings. Follow this repository's `SECURITY.md` where available and report vulnerabilities through the documented disclosure process.
+
+## Governance rule
+
+`Claim != Evidence`. `CURRENT != TARGET`. A green workflow or repository artifact proves only its declared scope. Public claim promotion requires control-plane authorization and human review where configured.
+
+## Control plane
+
+The authoritative governance source is the private `Traky12/castuo-evolution` repository. This file is explanatory only and must not be used to promote repository state manually.

governance/castuo-standard-reference.yaml

@@ -0,0 +1,11 @@
+standard_id: CASTUO-REPOSITORY-STANDARD-V1.0
+version: "1.0"
+canonical_repository: Traky12/castuo-evolution
+canonical_path: docs/CASTUO-REPOSITORY-STANDARD-V1.0.md
+vocabulary_source: Traky12/castuo-evolution/governance/master-vocabulary.yaml
+annex_source: Traky12/castuo-evolution/docs/standard-v1.0/
+control_plane: castuo-evolution
+reference_mode: CANONICAL_REFERENCE_NOT_COPY
+validation: castuo-evolution/scripts/validate_repository_conformance.py
+production: NOT_CLAIMED
+promotion: BLOCKED_UNTIL_LOCAL_SCOPE_EVIDENCE

repository.yaml

@@ -0,0 +1,42 @@
+id: CASTUO-REPOSITORY-CAST_O
+name: Cast-o
+class: CI
+visibility: PUBLIC
+owner: Traky12
+parent_system: CASTUO-SYSTEM
+lifecycle: ACTIVE
+scope: CI validation and release evidence
+current_state: CANDIDATE
+assurance_level: L0_CONTRACT_DEFINED
+evidence_state: EVIDENCE_PENDING
+production_claim: NOT_CLAIMED
+relationships:
+  upstream: []
+  downstream: [castuo-evolution]
+  peers: []
+claims_blocked:
+  - production
+  - certification
+  - independent_validation
+  - autonomous_authority
+  - commercial_validation
+  - federation
+metadata_source: CASTUO-REPOSITORY-STANDARD-V1.0
+repository: Cast-o
+purpose: CI validation and release evidence
+environment: STAGING
+implementation_state: CANDIDATE
+security_state: EVIDENCE_PENDING
+promotion_state: PROMOTION_BLOCKED
+claims_allowed:
+  - documented repository role within declared scope
+claims_blocked:
+  - production
+  - certification
+  - independent_validation
+  - autonomous_authority
+  - commercial_validation
+  - federation
+dependencies: []
+upstream: []
+downstream: [castuo-evolution]

scripts/run_castuo_repository_conformance.py

@@ -0,0 +1,54 @@
+"""Run the canonical CASTUO repository conformance validator.
+
+This adapter intentionally contains no vocabulary or promotion semantics. The
+source of truth is the validator shipped by castuo-evolution.
+"""
+from __future__ import annotations
+
+import argparse
+import importlib.util
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+
+
+def load_validator(path: Path):
+    spec = importlib.util.spec_from_file_location("castuo_canonical_validator", path)
+    if spec is None or spec.loader is None:
+        raise RuntimeError(f"cannot load canonical validator: {path}")
+    module = importlib.util.module_from_spec(spec)
+    spec.loader.exec_module(module)
+    return module
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description="Run canonical CASTUO V1.0 conformance")
+    parser.add_argument("--standard-root", type=Path, required=True)
+    parser.add_argument("--repository-root", type=Path, default=Path.cwd())
+    parser.add_argument("--output", type=Path, default=Path("artifacts/castuo-repository-conformance.json"))
+    args = parser.parse_args()
+
+    validator_path = args.standard_root / "scripts" / "validate_repository_conformance.py"
+    if not validator_path.is_file():
+        raise SystemExit(f"BLOCKED:canonical_validator_missing:{validator_path}")
+    module = load_validator(validator_path)
+    findings = module.validate(args.repository_root.resolve())
+    blocked = any(item.startswith("BLOCKED:") for item in findings)
+    status = "BLOCKED" if blocked else ("WARNING" if findings else "PASS")
+    report = {
+        "standard": "CASTUO-REPOSITORY-STANDARD-V1.0",
+        "validator_source": str(validator_path),
+        "repository_root": str(args.repository_root.resolve()),
+        "status": status,
+        "findings": findings,
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+        "semantic_owner": "castuo-evolution",
+    }
+    args.output.parent.mkdir(parents=True, exist_ok=True)
+    args.output.write_text(json.dumps(report, indent=2) + "\n")
+    print(json.dumps(report, indent=2))
+    return 1 if blocked else 0
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())