surface_id	kind	current_identity	locations	semantic_owner	history	disposition	compatibility_boundary	retirement_evidence	coordination_owner
product-name	product-prose	APTL → LilRAE (one product across a rename)	README.md; docs/adrs/adr-054-lilrae-core-and-experience-ownership.md; docs/reviews/962-lilrae-readiness/README.md; pyproject.toml	LilRAE product	615d4680 establishes the APTL repository; d48d2b7e records the readiness review; #934 corrects its identity model	correct now for current prose; rename technical identities only through their own rows	none; prose cannot authorize an alias or parallel runtime	current decision prose states identity continuity and every retained APTL literal has an individual disposition	APTL #934; OpenRAE/lilrae#3
adr-054-legacy-locator	historical-record	docs/adrs/adr-054-lilrae-core-and-experience-ownership.md	docs/adrs/adr-054-lilrae-core-and-experience-ownership.md; docs/adrs/README.md; mkdocs.yml	repository governance	c1497e42 introduced the proposed ADR path; d48d2b7e integrated it	retain technical identity as a legacy locator while the proposed title is corrected in place	the filename alone is the compatibility locator; it conveys no architecture	audit incoming links before any later filename retirement and provide a redirect or migration note	APTL #934
github-repository	repository	Brad-Edwards/aptl	pyproject.toml; .ground-control.yaml; release-please-config.json; .github/workflows/; README.md	repository governance	615d4680 is the initial repository history anchor	rename later; no repository move is chosen here	Git remote and published GitHub URLs are the only boundary; no mirrored repository is authorized	destination repository, redirect/archive policy, CI/protection transfer, release provenance, and consumer guidance	OpenRAE/lilrae#3
python-distribution	distribution	aptl-labs	pyproject.toml; .release-please-manifest.json; release-please-config.json; .github/workflows/release-please.yml; hatch_build.py	LilRAE product	8b9174a9 established the published aptl-labs distribution	rename later; retain current published identity	Python package index project identity; no alias distribution is added by #934	released replacement wheel, dependency and SBOM provenance, installed-wheel parity, upgrade guidance, and old-project retirement notice	OpenRAE/lilrae#3; APTL #970
python-import-root	import-root	aptl	pyproject.toml; src/aptl/; tests/; hatch_build.py	LilRAE product	7815b5f4 introduced the Python CLI/package lineage	rename later; retain technical identity	one Python import root; no aptl/lilrae compatibility package or dynamic import fallback	public-import migration plan, downstream import proof, wheel parity, and one bounded compatibility decision	OpenRAE/lilrae#3; APTL #970
primary-cli	cli	aptl	pyproject.toml; src/aptl/cli/main.py; docs/getting-started/; README.md	LilRAE product	7815b5f4 introduced the CLI lineage	rename later; retain command until a released cutover is selected	pyproject.toml project.scripts is the sole command owner; no second CLI is added	released replacement command, human and JSON route parity, shell/documentation migration, and a removal window	OpenRAE/lilrae#3
misp-sync-cli	cli	aptl-misp-suricata-sync	pyproject.toml; src/aptl/services/misp_suricata_sync/; docker-compose.yml; config/suricata/suricata.yaml	TechVault pack integration	Git history is authoritative; first-introduction detail is immaterial to the rename boundary	retain technical identity until the selected TechVault integration is separately packaged or retired	pyproject.toml project.scripts and the Compose service are the only producers/consumers	released integration replacement, TechVault parity, config migration, and removal from generic installation	APTL #880; APTL #970
primary-config-file	config-env	aptl.json	src/aptl/core/config.py; src/aptl/core/assets.py; src/aptl/cli/config.py; aptl.json; docs/deployment.md	LilRAE product	00fe44bd bound the installed-wheel materialization path to the current config filename	rename later; retain strict current identity	AptlConfig and load_config() are the single strict reader; no dual sections or last-one-wins aliases	versioned config migration, strict conflict rejection, installed-project upgrade guidance, and reader retirement window	OpenRAE/lilrae#3; APTL #970
environment-namespace	config-env	APTL_*	src/aptl/core/env.py; src/aptl/core/config.py; src/aptl/utils/redaction.py; docker-compose.yml; .env.example	LilRAE product and selected integrations	Git history is authoritative; individual keys have independent introduction commits	rename later by key family; retain current names and never inventory values	EnvVars, hydrate_dotenv(), load_dotenv(), WebAuthSettings, ServiceConfig.from_env(), and MCP common config remain the readers	per-consumer key inventory, precedence/conflict policy, redaction proof, credential-safe guidance, and removal window	OpenRAE/lilrae#3; APTL #970
mcp-config-contract	config-env	docker-lab-config.json with APTL_* envPrefix values	mcp/aptl-mcp-common/src/config.ts; mcp/*/docker-lab-config.json; src/aptl/core/lab.py; src/aptl/cli/lab_render.py	TechVault pack integrations	Git history is authoritative; first-introduction detail is immaterial to the rename boundary	retain technical identity; any later rename occurs once in the shared loader	mcp/aptl-mcp-common/src/config.ts is the shared runtime loader; the LabConfig interface alone is not validation	fail-closed shared-loader tests, every dependent MCP rebuild, generated-client parity, and explicit conflict behavior	APTL #970; OpenRAE/lilrae#3
raes-backend-target	backend-target	aptl / full-remote-control-plane	src/aptl/backends/identity.py; src/aptl/backends/raes_manifest.py; tests/test_raes_backend.py	LilRAE product	ced66dcc establishes the RAES namespace cutover; later manifest commits retain the target identity	rename later only with a versioned RAES capability and conformance decision	BackendIdentity plus the RAES manifest is the boundary; class names and config providers are not aliases	released target manifest, conformance and native-readback parity, consumer discovery migration, and old-target rejection policy	OpenRAE/lilrae#3; OpenRAE/lilrae#4
scenario-verifier-group	plugin	aptl.scenario_verifiers	src/aptl/validation/scenario_verification.py; src/aptl/validation/scenario_verification_discovery.py; src/aptl_techvault/verification.py	LilRAE product plugin boundary; TechVault implementation	7b21cdbd introduced the scenario-verification plugin seam	retain technical identity pending an exact producer/consumer cutover	the installed entry-point group is the only discovery boundary; config and CLI cannot select imports	released replacement group, installed-distribution provenance, digest compatibility, fail-closed discovery, and plugin migration guidance	APTL #878; APTL #879; OpenRAE/lilrae#3
pack-interaction-group	plugin	aptl.pack_backend_interactions	src/aptl/backends/pack_interaction.py; src/aptl/backends/pack_interaction_discovery.py; src/aptl_techvault/serving.py	LilRAE product plugin boundary; TechVault implementation	ebb4db29 introduced the pack/backend serving-interaction seam	retain technical identity pending an exact producer/consumer cutover	the installed entry-point group is the only discovery boundary; pack data cannot name Python imports	released replacement group, exact pack compatibility, installed-distribution provenance, and old-group rejection policy	APTL #880; OpenRAE/lilrae#3
techvault-plugin-distributions	plugin	aptl_techvault	src/aptl_techvault/; tests/test_scenario_verification_plugin.py; tests/test_pack_backend_interaction.py	TechVault pack	7b21cdbd and ebb4db29 introduced the two installed plugin seams	rename or relocate later with the TechVault pack; not part of a product split	installed distribution plus exact entry-point compatibility metadata	released plugin artifacts, pack/version/digest qualification, install/uninstall guidance, and generic-product independence proof	APTL #878; APTL #879; APTL #880
telemetry-namespace	telemetry	aptl logger, service, and attribute namespaces	src/aptl/utils/logging.py; src/aptl/core/telemetry.py; mcp/aptl-mcp-common/src/telemetry.ts; config/otel/; docker-compose.yml	LilRAE product	Git history is authoritative; telemetry names accumulated across implementation slices	rename later as a versioned observability contract; retain current names	get_logger(), telemetry initialization, and the MCP common telemetry helper are the only writers	dashboard/query migration, dual-read window if required, redaction and cardinality checks, and old-namespace retirement	OpenRAE/lilrae#3; APTL #969
persisted-schema-family	persisted-schema	aptl.* and aptl-* schema/version identifiers	src/aptl/core/archival/; src/aptl/core/correlation/; src/aptl/core/evidence_bundle/; src/aptl/backends/raes_repro.py; src/aptl/appliance/; tests/	LilRAE product and immutable historical evidence	a4423db9 and later evidence/appliance commits establish versioned writer history	version with reader; never rewrite sealed or content-addressed records	versioned schema dispatch and core/archival/legacy_manifest.py contain compatibility	new writer schema, one bounded legacy reader, fixture/archive verification, migration window, and explicit unsupported-version diagnostics	OpenRAE/lilrae#3; APTL #970
local-state-root	state-path	.aptl	src/aptl/core/assets.py; src/aptl/core/session.py; src/aptl/core/runstore.py; src/aptl/core/credentials.py; src/aptl/core/deployment/; docker-compose.yml	LilRAE product	00fe44bd distinguishes generated state from installed tracked assets; earlier state history remains in Git	rename later only with a user-data reader/migration policy	the project-root state accessors and no-follow path utilities contain compatibility	ownership-safe migration, permissions and symlink checks, legacy reader window, rollback guidance, and no silent fallback	OpenRAE/lilrae#3; APTL #970
compose-native-identities	image-native-resource	deployment.project_name; org.aptl.realization.*; aptl.lifecycle.project; aptl-* container/network/volume names	src/aptl/core/config.py; src/aptl/core/deployment/; docker-compose.yml; tests/test_deployment_backend.py	LilRAE product runtime	a4423db9 introduced the org.aptl realization labels; subsequent lifecycle work added project-scoped identities	retain technical identity until an ownership-safe native migration is specified	DeploymentBackend project identity and verified Docker labels/IDs are the boundary; names alone never prove ownership	two-workspace/native-ID proof, migration of existing resources, cleanup safety, collision rejection, and teardown evidence	APTL #964; APTL #970; OpenRAE/lilrae#3
generic-systemd-debian-image	image-native-resource	aptl/generic-systemd-base-debian:latest	containers/generic-systemd-base-debian/Dockerfile (producer); src/aptl/core/deployment/_compose_base_substrate.py (local builder and consumer); src/aptl/backends/raes_materializer.py (selector); tests/test_compose_base_substrate.py	LilRAE product runtime	421a836d introduced the Debian generic systemd substrate and its exact local tag	retain the local-only identity; rename later with the product runtime and do not imply a registry release	_SERVICE_BASE_IMAGE selection, the exact build-context map, and the inspected local image ID form the boundary; no GHCR identity exists	replacement local tag builds from the same pinned Dockerfile on a fresh machine and from an offline appliance, RAES realization parity passes, consumers select only the replacement, and the old local tag is no longer required	OpenRAE/lilrae#3; APTL #970
generic-systemd-rhel-image	image-native-resource	aptl/generic-systemd-base:latest	containers/generic-systemd-base/Dockerfile (producer); src/aptl/core/deployment/_compose_base_substrate.py (local builder and consumer); src/aptl/backends/raes_materializer.py (selector); tests/test_compose_base_substrate.py	LilRAE product runtime	421a836d introduced the RHEL-family generic systemd substrate and its exact local tag	retain the local-only identity; rename later with the product runtime and do not imply a registry release	_SERVICE_BASE_IMAGE selection, the exact build-context map, and the inspected local image ID form the boundary; no GHCR identity exists	replacement local tag builds from the same pinned Dockerfile on a fresh machine and from an offline appliance, RAES realization parity passes, consumers select only the replacement, and the old local tag is no longer required	OpenRAE/lilrae#3; APTL #970
generic-systemd-node22-image	image-native-resource	aptl/generic-systemd-node22-base:latest	containers/generic-systemd-node22-base/Dockerfile (producer); src/aptl/core/deployment/_compose_base_substrate.py (local builder and consumer); src/aptl/backends/_raes_backend_implementation_profiles.py (selector); tests/test_compose_base_substrate.py	LilRAE product runtime	APTL #992 introduced the Node.js 22 systemd substrate as an open backend implementation choice	retain the local-only identity; rename later with the product runtime and do not imply a registry release	semantic backend selection, the exact build-context map, and the inspected local image ID form the boundary; no registry identity exists	replacement local tag builds from the same pinned Dockerfile on a fresh machine and from an offline appliance, RAES realization parity passes, consumers select only the replacement, and the old local tag is no longer required	OpenRAE/lilrae#3; APTL #992
generic-samba-ad-image	image-native-resource	aptl/generic-samba-ad-base:latest	containers/generic-samba-ad-base/Dockerfile and provider scripts (producer); src/aptl/core/deployment/_compose_base_substrate.py (local builder and consumer); src/aptl/backends/_raes_backend_implementation_profiles.py (semantic selector); tests/test_compose_base_substrate.py	LilRAE product runtime	APTL #992 introduced a scenario-neutral Samba provider for open identity-authority substrate selection	retain the local-only identity; rename later with the product runtime and do not imply a registry release	semantic identity-authority selection, exact provider parameters, the build-context map, and the inspected local image ID form the boundary; no registry identity exists	replacement local tag builds from the same pinned Dockerfile on a fresh machine and from an offline appliance, domain readback passes, consumers select only the replacement, and the old local tag is no longer required	OpenRAE/lilrae#3; APTL #992
wazuh-sidecar-image	image-native-resource	aptl-wazuh-sidecar:local	containers/wazuh-sidecar/Dockerfile (producer); docker-compose.yml wazuh-sidecar-db and wazuh-sidecar-suricata services (build producers and consumers); .github/workflows/checks.yml wazuh-sidecar matrix entry (CI consumer)	TechVault pack integration	73824e26 introduced the current sidecar Dockerfile; the Compose services retain the exact local tag	retain the local-only identity until the TechVault integration is released from its selected owner, then relocate or retire it with the pack	Dockerfile plus the two named Compose services are the complete runtime boundary; the aptl-scan/wazuh-sidecar:ci tag is ephemeral CI output, not a released identity	released digest-qualified replacement integration, Wazuh event parity for both consumers, SBOM and provenance, fresh-machine and installed-wheel builds, consumer migration, and proof the old local tag is unused	APTL #880; APTL #970
legacy-static-route	static-route	project-tree bundle and root docker-compose.yml	src/aptl/core/scenario_bundle.py; src/aptl/core/lab.py; src/aptl/core/assets.py; src/aptl/cli/lab_init.py; src/aptl/core/deployment/; _asset_manifest.py; hatch_build.py; docker-compose.yml	LilRAE product compatibility path and TechVault pack content	00fe44bd bundled the static tree; 4dcf07bd added env-pack consumption; d48d2b7e records the review baseline	retire after parity; #934 does not remove or rename it	ScenarioSourceConfig/ScenarioSourceKind, project_tree_bundle(), ComposeProfileIndex, asset manifest, and lab-init materialization contain the route	same released digest-identified pack proves acquisition, admission, realization, observation, reset, teardown, and installed-wheel behavior; user data has a reader; no config/CLI/test/packaging route selects the static path	APTL #880; APTL #970
techvault-pack	scenario-pack	techvault	OpenRAE/env-packs/packs/techvault; scenarios/techvault*.sdl.yaml; docs/reference/techvault-*; src/aptl_techvault/; src/aptl/validation/techvault_*	TechVault pack; format and current bytes owned by OpenRAE/env-packs	4dcf07bd established env-pack consumption; 7b21cdbd and ebb4db29 added verifier/interaction seams	externally owned scenario pack; reconcile residual copies without treating it as a product	ScenarioBundle, PackIdentity, ScenarioCatalog, env-pack validation, and installed plugin compatibility	released pack/version/digest parity, residual-copy inventory, installed plugin proof, and removal of silent nearby-static fallback	APTL #880; OpenRAE/env-packs
raes-manifest-authority-fallback	import-root	BACKEND_SUPPORTED_CONTRACT_IDS ImportError fallback	src/aptl/backends/raes_manifest.py; tests/test_raes_namespace_cutover.py	LilRAE product consumer of RAES contracts	ced66dcc is the namespace cutover anchor; d48d2b7e records the older-package fallback	retire after the minimum RAES version guarantees manifest_authority	the narrow ImportError block is the only fallback; broad import swallowing is forbidden	pinned RAES public symbol, manifest/conformance parity, and removal test proving older packages fail clearly	OpenRAE/rae; OpenRAE/lilrae#3
immutable-evidence	historical-record	accepted ADRs, requirement history, sealed archives, signed release evidence, and content-addressed validation artifacts	docs/adrs/adr-000-use-adrs.md; docs/requirements/; docs/reviews/962-lilrae-readiness/evidence/; src/aptl/core/archival/	immutable historical evidence	repository Git history and each artifact's own digest/signature are authoritative	historical immutable; correct current interpretation around it without rewriting bytes	Git history, schema-version readers, archive seals, signatures, and content digests	reader verification, preserved signature/digest identity, and explicit current guidance that supersedes only interpretation	repository governance; APTL #934
coordination-wording	historical-record	APTL experience and separate APTL-to-LilRAE migration wording in linked issue records	https://github.com/Brad-Edwards/aptl/issues/970; https://github.com/OpenRAE/lilrae/issues/3; docs/reviews/962-lilrae-readiness/backlog-disposition.md; docs/reviews/962-lilrae-readiness/delivery-plan.md	repository governance across the APTL/LilRAE rename	issue #970 and OpenRAE/lilrae#3 are live coordination records read on 2026-09-05	correct repository records now; linked issue owners must reconcile live wording without changing this audit into cross-repository implementation	issue links and this ledger carry the coordination boundary; no code compatibility is implied	linked plans adopt identity continuity, TechVault-as-pack wording, and this ledger before technical cutover or release naming	APTL #970; OpenRAE/lilrae#3