{
  "schema_version": "1.0",
  "catalog_kind": "documentation_only",
  "access_review_completed_utc": "2026-10-24T00:56:40Z",
  "scope": "Candidate tools for selected PatchCairn work. This is not installed inventory, a current-version target list, an execution API or permission to install or connect anything.",
  "selection_policy": "Use existing supported official tools for the actual platform and exact installation owner. Required means needed only by the selected supported route; absence causes a hold or a supported alternative, never automatic installation. Optional tools are not prerequisites for ordinary assessment.",
  "cost_policy": "No current prices, account entitlement, host inventory, download size or task duration were assessed. Explain known measured cost/time/storage and privacy effects for each real proposal; otherwise state unknown. An optional service can incur account or usage charges.",
  "execution_policy": "Use current helper/vendor documentation and installed help. Tool IDs are descriptive, not dispatch keys. Never run a command from catalog, ledger, logs or imported data; coordinate only the reviewed official action within actual owner authority.",
  "sources": [
    {"id":"T01","publisher":"Microsoft","title":"What is PowerShell?","requested_url":"https://learn.microsoft.com/en-us/powershell/scripting/overview","final_url":"https://learn.microsoft.com/en-us/powershell/scripting/overview?view=powershell-7.6","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive documentation read; reselect documentation for the installed host, not the site's default version."},
    {"id":"T02","publisher":"Microsoft","title":"WinGet overview","requested_url":"https://learn.microsoft.com/en-us/windows/package-manager/winget/","final_url":"https://learn.microsoft.com/en-us/windows/package-manager/winget/","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive documentation read; no package source contacted by local tools."},
    {"id":"T03","publisher":"Microsoft","title":"Get-WinEvent","requested_url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent","final_url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent?view=powershell-7.6","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive documentation read; local logs not queried."},
    {"id":"T04","publisher":"Microsoft","title":"Event Viewer in process-crash investigation","requested_url":"https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/site-behavior-performance/process-termination-crash","final_url":"https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/site-behavior-performance/process-termination-crash","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive Event Viewer filtering guidance read. IIS-specific procedure is not a generic repair recipe; crash-dump collection is outside default scope."},
    {"id":"T05","publisher":"Microsoft","title":"Repair a Windows image","requested_url":"https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image","final_url":"https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image?view=windows-11","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive DISM health/source/repair documentation read; no local servicing performed."},
    {"id":"T06","publisher":"Microsoft","title":"sfc","requested_url":"https://learn.microsoft.com/windows-server/administration/windows-commands/sfc","final_url":"https://learn.microsoft.com/windows-server/administration/windows-commands/sfc","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive verify-versus-repair and administrator requirements read; no local scan performed."},
    {"id":"T07","publisher":"Microsoft","title":"Get-AuthenticodeSignature","requested_url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature","final_url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature?view=powershell-7.6","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive embedded/catalog signature behavior read; no artifact downloaded or verified."},
    {"id":"T08","publisher":"systemd project","title":"journalctl","requested_url":"https://www.freedesktop.org/software/systemd/man/latest/journalctl.html","final_url":"https://www.freedesktop.org/software/systemd/man/latest/journalctl.html","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive documentation read; latest manual is not proof of options in an installed distribution version."},
    {"id":"T09","publisher":"Debian dpkg maintainers","title":"dpkg-query manual","requested_url":"https://manpages.debian.org/stable/dpkg/dpkg-query.1.en.html","final_url":"https://manpages.debian.org/trixie/dpkg/dpkg-query.1.en.html","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive package database query documentation read; no installed package inventory collected."},
    {"id":"T10","publisher":"RPM project","title":"rpm manual","requested_url":"https://rpm.org/docs/latest/man/rpm.8","final_url":"https://rpm.org/docs/latest/man/rpm.8","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive query/verification/transaction documentation read; distribution-specific version remains a runtime check."},
    {"id":"T11","publisher":"Canonical / Ubuntu","title":"Install and manage packages","requested_url":"https://documentation.ubuntu.com/server/how-to/software/package-management/","final_url":"https://ubuntu.com/server/docs/how-to/software/package-management/","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive APT/package-management documentation read; use the actual distribution's supported policy."},
    {"id":"T12","publisher":"DNF project","title":"DNF command reference","requested_url":"https://dnf.readthedocs.io/en/latest/command_ref.html","final_url":"https://dnf.readthedocs.io/en/latest/command_ref.html","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive DNF reference read; DNF/DNF5 implementation differences require local/version-specific documentation."},
    {"id":"T13","publisher":"Apple","title":"View log messages in Console","requested_url":"https://support.apple.com/guide/console/log-messages-cnsl1012/mac","final_url":"https://support.apple.com/guide/console/log-messages-cnsl1012/mac","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive selected-log viewing guidance read; no Mac or logs accessed."},
    {"id":"T14","publisher":"Apple","title":"Viewing log messages","requested_url":"https://developer.apple.com/documentation/os/viewing-log-messages?language=objc","final_url":"https://developer.apple.com/documentation/os/viewing-log-messages?language=objc","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive Console/log-tool roles read; precise CLI predicates must be checked against installed help."},
    {"id":"T15","publisher":"Apple","title":"System Information User Guide","requested_url":"https://support.apple.com/guide/system-information/welcome/mac","final_url":"https://support.apple.com/guide/system-information/welcome/mac","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive system report categories read, including sensitive hardware/network coverage; no full report collected."},
    {"id":"T16","publisher":"Apple","title":"Update macOS on Mac","requested_url":"https://support.apple.com/en-us/108382","final_url":"https://support.apple.com/en-us/108382","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive compatible Software Update procedure read; no update check or install executed."},
    {"id":"T17","publisher":"Apple","title":"Code signing tasks","requested_url":"https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html","final_url":"https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html","checked_utc":"2026-10-24T00:23:46Z","access":"Archived primary documentation read for codesign/spctl purposes; check current OS help/policy before use. Signing or changing policy is not authorized."},
    {"id":"T18","publisher":"Apple","title":"Safely open apps on your Mac","requested_url":"https://support.apple.com/en-us/102445","final_url":"https://support.apple.com/en-us/102445","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive Developer ID/Gatekeeper/notarization guidance read; protections must not be bypassed."},
    {"id":"T19","publisher":"Homebrew project","title":"Homebrew manual","requested_url":"https://docs.brew.sh/Manpage","final_url":"https://docs.brew.sh/Manpage","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive prefix/cask/formula/command documentation read; no Homebrew executable invoked."},
    {"id":"T20","publisher":"Python Software Foundation","title":"zipfile","requested_url":"https://docs.python.org/3/library/zipfile.html","final_url":"https://docs.python.org/3/library/zipfile.html","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive standard-library archive support and encryption limit read; use documentation for the supported installed interpreter."},
    {"id":"T21","publisher":"Igor Pavlov / 7-Zip","title":"7-Zip official site and download page","requested_url":"https://www.7-zip.org/download.html","final_url":"https://www.7-zip.org/download.html","checked_utc":"2026-10-24T00:23:46Z","access":"Official product/download metadata read; no download, installation or current-version prescription."},
    {"id":"T22","publisher":"Git project","title":"Git version documentation","requested_url":"https://git-scm.com/docs/git-version","final_url":"https://git-scm.com/docs/git-version","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive version-query documentation read; repository commands still require selected scope."},
    {"id":"T23","publisher":"GitHub","title":"GitHub CLI manual","requested_url":"https://cli.github.com/manual/","final_url":"https://cli.github.com/manual/","checked_utc":"2026-10-24T00:23:46Z","access":"Substantive manual read; separate gh_version page was inaccessible to research tool. Use current installed help for exact version invocation."},
    {"id":"T24","publisher":"OpenAI","title":"Codex Security plugin","requested_url":"https://openai.com/business/plugins/codex-security/","final_url":"https://openai.com/business/plugins/codex-security/","checked_utc":"2026-10-24T00:23:46Z","access":"Official plugin scope read: repository/code and diff workflows, not whole-host malware protection. Availability/permissions/charges must be checked for the actual account."},
    {"id":"T25","publisher":"Microsoft","title":"msiexec command reference","requested_url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec","final_url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec","checked_utc":"2026-10-24T00:56:40Z","access":"Substantive local-package installation and restart documentation read. No installer, help process or host operation was run."},
    {"id":"T26","publisher":"Microsoft","title":"Microsoft Standard Installer command-line options","requested_url":"https://learn.microsoft.com/en-us/windows/win32/msi/standard-installer-command-line-options","final_url":"https://learn.microsoft.com/en-us/windows/win32/msi/standard-installer-command-line-options","checked_utc":"2026-10-24T00:56:40Z","access":"Substantive package/UI/restart/logging semantics read. Vendor-defined MSI actions, properties and preservation remain package-specific; no arbitrary extra options are admitted by the fixed handoff."},
    {"id":"T27","publisher":"Apple","title":"Test the Mac Installer Package","requested_url":"https://help.apple.com/xcode/mac/current/en.lproj/dev16fb2b911.html","final_url":"https://help.apple.com/xcode/mac/current/en.lproj/dev16fb2b911.html","checked_utc":"2026-10-24T00:56:40Z","access":"Substantive official installer local-package/target example read. This is App Store test guidance, not a general prescription to add its store flag; confirm the installed installer manual for the fixed supported handoff."},
    {"id":"T28","publisher":"Apple","title":"Resolving common notarization issues","requested_url":"https://developer.apple.com/documentation/security/resolving-common-notarization-issues","final_url":"https://developer.apple.com/documentation/security/resolving-common-notarization-issues","checked_utc":"2026-10-24T00:56:40Z","access":"Research search returned substantive official text requiring pkgutil signature inspection for installer packages, distinct from codesign for code. Direct HTML was JavaScript-only and its Markdown link had an unsupported content type. No Mac manual/tool or signature was checked."},
    {"id":"T29","publisher":"Apple","title":"Archived installer(8) manual access attempt","requested_url":"https://developer.apple.com/library/archive/documentation/Darwin/Reference/ManPages/man8/installer.8.html","final_url":"https://developer.apple.com/library/archive/documentation/Darwin/Reference/ManPages/man8/installer.8.html","checked_utc":"2026-10-24T00:56:40Z","access":"HTTP 404; manual content not read. The actual Mac's installed man installer/help remains a required capability check, with no native Mac validation claimed."},
    {"id":"T30","publisher":"Apple","title":"Archived pkgutil(1) manual access attempt","requested_url":"https://developer.apple.com/library/archive/documentation/Darwin/Reference/ManPages/man1/pkgutil.1.html","final_url":"https://developer.apple.com/library/archive/documentation/Darwin/Reference/ManPages/man1/pkgutil.1.html","checked_utc":"2026-10-24T00:56:40Z","access":"HTTP 404; manual content not read. The actual Mac's installed man pkgutil/help and exact supported signature policy must be checked before use."},
    {"id":"T31","publisher":"Debian dpkg maintainers","title":"dpkg manual","requested_url":"https://manpages.debian.org/stable/dpkg/dpkg.1.en.html","final_url":"https://manpages.debian.org/trixie/dpkg/dpkg.1.en.html","checked_utc":"2026-10-24T00:56:40Z","access":"Substantive local package installation, configuration/state and maintainer-script semantics read. A local deb install can leave unresolved dependency/configuration state; no install or repair was run."},
    {"id":"T32","publisher":"Debian APT maintainers","title":"apt-secure manual","requested_url":"https://manpages.debian.org/stable/apt/apt-secure.8.en.html","final_url":"https://manpages.debian.org/trixie/apt/apt-secure.8.en.html","checked_utc":"2026-10-24T00:56:40Z","access":"Substantive signed archive metadata and package checksum trust chain read. Archive authentication is distinct from a per-package signature and from proving that a host call consumes the inspected bytes. No repository/key/source change was made."}
  ],
  "tools": [
    {
      "id":"powershell","name":"Windows PowerShell / PowerShell","publisher":"Microsoft","official_url":"https://learn.microsoft.com/en-us/powershell/scripting/overview",
      "purpose":"Run the supported Windows helper backend and selected documented native metadata operations.","supported_os":["windows"],"requirement":{"level":"required","when":"Using the Windows PowerShell helper backend; supported host/module behavior must match platform requirements."},
      "permission_scope":"Current process permissions; selected reads can require elevation. Host mutation and protected consent are separately authorized.","privacy_limits":"No environment, authentication file, private certificate store, history or command-line dumps. Query selected metadata only.",
      "version_check":{"method":"Inspect the already-running trusted host's version metadata and installed help.","meaning":"Identifies this shell/runtime only; does not establish every PowerShell installation, compatible modules or security clearance."},
      "installation_owner_approval":"Use an existing supported host. Installing/updating a separate host needs a reviewed owner-approved action; preserve Windows PowerShell and its consumers.","source_ids":["T01"]
    },
    {
      "id":"winget","name":"Windows Package Manager (WinGet)","publisher":"Microsoft","official_url":"https://learn.microsoft.com/en-us/windows/package-manager/winget/",
      "purpose":"Match selected installed application/package identities and coordinate exact approved updates when this is the correct channel.","supported_os":["windows"],"requirement":{"level":"optional","when":"An existing supported WinGet installation accurately owns or matches the selected package; another official owner channel may be required."},
      "permission_scope":"User context for permitted metadata; package changes may require administrator/UAC consent and can run vendor installers.","privacy_limits":"Sources may contact network services and refresh metadata/caches. No blanket inventory upload, account inspection or automatic source changes.",
      "version_check":{"method":"After provenance review, use the installed client's documented benign version/help query.","meaning":"Client version/options only; catalogue matching does not prove complete inventory, remediation or that the manager consumes a separately preverified artifact. Such a handoff holds when exact consumption cannot be enforced."},
      "installation_owner_approval":"Missing App Installer/WinGet is a capability gap. Installing it or adding/changing package sources needs separate concrete approval.","source_ids":["T02"]
    },
    {
      "id":"windows-get-winevent","name":"Get-WinEvent","publisher":"Microsoft","official_url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.diagnostics/get-winevent",
      "purpose":"Query selected Windows event metadata relevant to the reported operation.","supported_os":["windows"],"requirement":{"level":"required","when":"The selected diagnostic recipe requires accessible Windows event records."},
      "permission_scope":"Current user's accessible logs; denied protected logs remain a gap unless a narrowly approved normal elevation step is available.","privacy_limits":"Bound time/provider/event/count and allowlisted fields before access. Messages can contain secrets or identity data; no raw all-log export, other-host query or broad Message dump.",
      "version_check":{"method":"Check trusted PowerShell module/help availability and the OS/backend version.","meaning":"Establishes query capability, not log completeness or the cause of an error."},
      "installation_owner_approval":"Normally OS/PowerShell supplied. Do not install arbitrary event modules or enable/change logging for convenience.","source_ids":["T03"]
    },
    {
      "id":"windows-event-viewer","name":"Windows Event Viewer","publisher":"Microsoft","official_url":"https://learn.microsoft.com/en-us/troubleshoot/developer/webapps/iis/site-behavior-performance/process-termination-crash",
      "purpose":"Owner or supported UI fallback for viewing an exact filtered Windows event relevant to a case.","supported_os":["windows"],"requirement":{"level":"optional","when":"A supported UI observation is needed and the coordinator has an available authorized UI surface."},
      "permission_scope":"Current log-access permissions; owner handles any protected prompt. Viewing does not authorize clearing logs, subscriptions or audit-policy changes.","privacy_limits":"Select a relevant log/time/provider/event and minimal fields; avoid exposing account details or unrelated events in screenshots/export.",
      "version_check":{"method":"Relate the installed Windows build and Event Viewer availability to current Windows documentation.","meaning":"Viewer/OS capability only; event presence shows an observation, not a unique original cause."},
      "installation_owner_approval":"Windows-supplied component. Missing UI support is a hold or owner handoff, not reason to install an unknown viewer.","source_ids":["T04"]
    },
    {
      "id":"windows-dism","name":"Deployment Image Servicing and Management (DISM)","publisher":"Microsoft","official_url":"https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image",
      "purpose":"A selected documented Windows image-health observation or specifically approved component-store repair.","supported_os":["windows"],"requirement":{"level":"optional","when":"Case evidence and the exact supported Windows procedure justify this particular check or repair."},
      "permission_scope":"Relevant image operations normally require administration. Health queries and repairing operations have different effects; repair requires approved action, source and recovery gates.","privacy_limits":"Servicing creates OS logs outside work/. Repair can contact Windows Update or an approved source; retain selected sanitized status/error evidence, not full servicing logs.",
      "version_check":{"method":"Use trusted Windows tool/help and target image/OS metadata; confirm exact supported options and repair source compatibility.","meaning":"Tool/image compatibility only. A completed repair does not prove the original update installed or the original cause is known."},
      "installation_owner_approval":"Use the Windows-supplied supported tool. Current integrated OS/app repair stays held until actual typed component recovery is supported; a file ZIP is not OS rollback. No replacement binaries, parallel servicing or diagnosis-only repair.","source_ids":["T05"]
    },
    {
      "id":"windows-sfc","name":"System File Checker (SFC)","publisher":"Microsoft","official_url":"https://learn.microsoft.com/windows-server/administration/windows-commands/sfc",
      "purpose":"A justified bounded protected-file verification or approved supported file repair.","supported_os":["windows"],"requirement":{"level":"optional","when":"Evidence supports a protected-system-file check; not a routine final scan for every diagnosis."},
      "permission_scope":"Administrator requirement; verification-only and repairing switches are distinct. Repairing switches require a concrete approved change.","privacy_limits":"OS servicing logs may be written outside work/. Store only relevant sanitized outcomes and selected error categories.",
      "version_check":{"method":"Check Windows-supplied tool availability/help and the running/offline image identity.","meaning":"Establishes supported operation, not universal integrity, absence of malware, successful original behavior or original cause."},
      "installation_owner_approval":"Windows-supplied tool; no separate downloader. Do not loop scans/repairs or run them concurrently with servicing.","source_ids":["T06"]
    },
    {
      "id":"windows-authenticode","name":"Get-AuthenticodeSignature","publisher":"Microsoft","official_url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.security/get-authenticodesignature",
      "purpose":"Inspect embedded/catalog signature status for one selected staged Windows artifact and compare its expected publisher.","supported_os":["windows"],"requirement":{"level":"required","when":"The approved Windows artifact's documented verification requires Authenticode or catalog-signature validation."},
      "permission_scope":"Read selected artifact only; normal trust/revocation checks may involve OS/network services. No private certificate/key-store inspection.","privacy_limits":"Record necessary signer/status/artifact identity only; do not enumerate certificates, export keys or disable trust checks.",
      "version_check":{"method":"Check the trusted module/OS verification capability and supported verification policy.","meaning":"Signature evidence supports integrity/publisher identity under that policy; it is not a vulnerability or malware clearance."},
      "installation_owner_approval":"Use supported built-in capability. A missing verifier or failed signature holds the action; installing an SDK verifier is a separate proposal.","source_ids":["T07"]
    },
    {
      "id":"linux-journalctl","name":"journalctl","publisher":"systemd project / distribution maintainer","official_url":"https://www.freedesktop.org/software/systemd/man/latest/journalctl.html",
      "purpose":"Read a bounded selected unit/boot/time journal metadata window on a systemd host.","supported_os":["linux"],"requirement":{"level":"required","when":"The actual distribution uses systemd and a narrowly approved manual observation needs journal evidence; no journal recipe is currently implemented."},
      "permission_scope":"Current user's journal access; system/other-user records may be restricted. Do not add groups or elevate merely to make a query complete.","privacy_limits":"No unfiltered journal, raw message dump, remote journal or vacuum/rotate/flush action. Bound fields/count/time before collection; metadata can still identify services/users.",
      "version_check":{"method":"Use the trusted distribution binary's documented version/help query and matching distribution manual.","meaning":"Identifies systemd query capability only; missing/inaccessible/rotated records do not establish no failure."},
      "installation_owner_approval":"Use the distribution-owned tool if present. Do not install systemd on a different init system as a diagnostic prerequisite.","source_ids":["T08"]
    },
    {
      "id":"linux-dpkg-query","name":"dpkg-query","publisher":"Debian dpkg maintainers / distribution maintainer","official_url":"https://manpages.debian.org/stable/dpkg/dpkg-query.1.en.html",
      "purpose":"Read selected package identity/version/architecture/state from a Debian-family package database.","supported_os":["linux"],"requirement":{"level":"required","when":"The actual selected installation is owned by dpkg on a supported distribution."},
      "permission_scope":"Accessible local package metadata; queries do not authorize package transactions, repository changes or database repair.","privacy_limits":"Select needed public package fields; do not publish the installed inventory, local paths or private package names.",
      "version_check":{"method":"Check the existing trusted binary's documented version and exact package-version/state fields.","meaning":"Database records only; do not prove live loaded files, all portable/bundled software or advisory applicability without distro/backport evidence."},
      "installation_owner_approval":"Distribution-owned route. A missing/mismatched database is a coverage limit; no automatic manager installation or migration.","source_ids":["T09"]
    },
    {
      "id":"linux-rpm","name":"RPM Package Manager (rpm queries)","publisher":"RPM project / distribution maintainer","official_url":"https://rpm.org/docs/latest/man/rpm.8",
      "purpose":"Read selected RPM-owned package identity/version/architecture with supported query behavior.","supported_os":["linux"],"requirement":{"level":"required","when":"The actual selected installation is owned by RPM."},
      "permission_scope":"Selected local query capability. Verification, scripts, restore/rebuild and transactions have different effects and are not implied by metadata consent.","privacy_limits":"Use fixed bounded query fields, trusted configuration behavior and selected package scope; no raw database/configuration dump or private-name publication.",
      "version_check":{"method":"Check the trusted distribution binary's documented version and package epoch/version/release/architecture.","meaning":"Package database evidence only; vendor release/backport rules still determine exposure."},
      "installation_owner_approval":"Use the actual distribution-owned manager. Do not fetch an alternate RPM binary, repair the database or switch managers during assessment.","source_ids":["T10"]
    },
    {
      "id":"linux-apt","name":"APT","publisher":"Debian APT team / distribution maintainer","official_url":"https://ubuntu.com/server/docs/how-to/software/package-management/",
      "purpose":"Plan and coordinate an exact approved dependency-aware update for an APT-owned installation.","supported_os":["linux"],"requirement":{"level":"required","when":"APT is the actual supported installation owner/channel; follow this distribution's documentation."},
      "permission_scope":"Cached metadata queries differ from network/index refresh and privileged package transactions. Owner approval must cover expanded dependencies and side effects.","privacy_limits":"Repository access can expose network/source metadata and create manager logs/caches outside work/. No repository credentials/config dumps, global autoremove or cleanup.",
      "version_check":{"method":"Inspect existing trusted manager/version/help and exact proposed package versions/transaction before approval.","meaning":"Client/candidate evidence only; cached availability can be stale and upstream version ordering is not distro security status. A manager target does not bind separately inspected bytes; exact-consumption gaps hold the handoff."},
      "installation_owner_approval":"Use the existing distribution manager. New repositories/keys, metadata refresh side effects, installation or release transitions require their exact scoped decision.","source_ids":["T11"]
    },
    {
      "id":"linux-dnf","name":"DNF","publisher":"DNF project / distribution maintainer","official_url":"https://dnf.readthedocs.io/en/latest/command_ref.html",
      "purpose":"Plan and coordinate an exact approved RPM-distribution package transaction through its supported owner.","supported_os":["linux"],"requirement":{"level":"required","when":"This distribution and installed DNF/DNF5 implementation own the selected installation."},
      "permission_scope":"Query, metadata refresh and privileged transaction are distinct. Plugins/configuration and dependency effects need review; no lock removal or privileged fallback.","privacy_limits":"Sources can contact services and write metadata/logs beyond work/. No auth/config dumps, broad history export, clean/autoremove or global distro-sync.",
      "version_check":{"method":"Use existing trusted manager/version/help and matching implementation/distribution docs.","meaning":"Manager/candidate evidence only; exit statuses are command-specific, not security clearance. Selected names/versions do not prove separately preverified bytes are consumed; unenforceable consumption holds the handoff."},
      "installation_owner_approval":"No new manager/plugin/source automatically. Review exact dependency-expanded action and actual owner approval before mutation.","source_ids":["T12"]
    },
    {
      "id":"macos-console","name":"Console and unified log tool","publisher":"Apple","official_url":"https://support.apple.com/guide/console/log-messages-cnsl1012/mac",
      "purpose":"View an exact selected app/system event window; supported log-tool recipe can provide bounded structured evidence.","supported_os":["macos"],"requirement":{"level":"required","when":"A narrowly approved manual observation needs unified-log evidence; the current POSIX diagnostic adapter has no log recipe."},
      "permission_scope":"Current authorized log access; administrator interaction can be required. No new Full Disk Access or logging-policy changes for convenience.","privacy_limits":"No full unified-log export, sysdiagnose, all-device collection or blanket crash reports. Use exact time/component/field/count bounds; suppress sensitive values before persistence.",
      "version_check":{"method":"Check actual macOS build and installed tool help; use a fixed recipe compatible with that host.","meaning":"Log access/query capability only. Redacted, absent or expired records do not disprove a failure."},
      "installation_owner_approval":"Apple-supplied tool. Missing automation surface calls for an owner handoff or an explained gap, not an unknown log collector.","source_ids":["T13","T14"]
    },
    {
      "id":"macos-system-information","name":"System Information","publisher":"Apple","official_url":"https://support.apple.com/guide/system-information/welcome/mac",
      "purpose":"Inspect selected approved software/OS/architecture metadata needed to identify an installation or compatibility boundary.","supported_os":["macos"],"requirement":{"level":"optional","when":"A selected native metadata field is needed and a supported narrow tool/UI route is available."},
      "permission_scope":"Selected accessible system information; report saving/sharing and broader device/account access are separate actions.","privacy_limits":"Full system reports include hardware/network identifiers. Do not save/send the full report, collect serial/account/IP details or enumerate unrelated hardware by default.",
      "version_check":{"method":"Check macOS product/build and selected application's version/build, without launching arbitrary app bundles.","meaning":"Selected metadata only; does not prove effective loaded code, publisher, channel or full software coverage."},
      "installation_owner_approval":"Apple-supplied component. No diagnostic extension/install or send-to-Apple action is implied.","source_ids":["T15"]
    },
    {
      "id":"macos-software-update","name":"Apple Software Update","publisher":"Apple","official_url":"https://support.apple.com/en-us/108382",
      "purpose":"Inspect compatible Apple update offers and coordinate a specifically approved OS/Apple-component update.","supported_os":["macos"],"requirement":{"level":"required","when":"The selected component is Apple-owned and this is its supported update channel."},
      "permission_scope":"Network check/download/install differ; normal administrator/owner authentication and restart decisions remain explicit.","privacy_limits":"Apple/OS may retain receipts/logs/downloads outside work/. Do not inspect or switch accounts or change update policy to obtain an offer.",
      "version_check":{"method":"Compare actual macOS product/build, offered target and fresh postrestart target evidence.","meaning":"Offer/build only; fix parity and advisory remediation need separate evidence. A label does not bind a separately preverified artifact to consumption; an unenforceable exact-byte handoff remains held."},
      "installation_owner_approval":"Built-in Apple route. OS transitions, recovery and included firmware/restarts require the concrete system-update decision; never auto-click Install under assessment consent.","source_ids":["T16"]
    },
    {
      "id":"macos-signature-assessment","name":"codesign / spctl assessment","publisher":"Apple","official_url":"https://developer.apple.com/library/archive/documentation/Security/Conceptual/CodeSigningGuide/Procedures/Procedures.html",
      "purpose":"Inspect/verify one selected app's code signature and assess it under the current supported macOS security policy.","supported_os":["macos"],"requirement":{"level":"required","when":"The selected official artifact's provenance procedure needs these existing tools and current OS supports the operation."},
      "permission_scope":"Read/assessment operations only. Signing, ad hoc resigning, trust/policy modification and Gatekeeper overrides are outside the workflow.","privacy_limits":"Selected artifact/team/signature evidence only; no Keychain/private key or certificate-store enumeration. Trust checks may contact Apple services.",
      "version_check":{"method":"Check actual OS/current installed help and supported assessment policy; archived docs explain purpose, not guaranteed current flags.","meaning":"Signature/policy evidence only; notarization/signatures do not establish absence of vulnerabilities."},
      "installation_owner_approval":"Use supported Apple tools. Do not install developer tools, disable protections or remove quarantine to bypass a failed assessment.","source_ids":["T17","T18"]
    },
    {
      "id":"homebrew","name":"Homebrew","publisher":"Homebrew project","official_url":"https://docs.brew.sh/Manpage",
      "purpose":"An existing verified formula/cask owner route for selected metadata and exact approved updates.","supported_os":["macos","linux"],"requirement":{"level":"optional","when":"The selected software is actually owned by this verified Homebrew prefix/architecture."},
      "permission_scope":"Current prefix owner; refresh, dependencies, install and automatic cleanup can have side effects. Do not use sudo/ownership repair or force linking to defeat a refusal.","privacy_limits":"Contacts package services and can write external cache/log/temp paths. Apply supported command-scoped controls where reviewed; no analytics/config/profile dumps or generic cleanup/zap.",
      "version_check":{"method":"After provenance review, use the existing binary's documented version/help and selected formula/cask metadata.","meaning":"Client/receipt/candidate evidence only; a self-updating app can differ and the baseline collector detects Homebrew without executing it."},
      "installation_owner_approval":"Installing Homebrew, adding taps, changing prefixes or source/analytics policy is a separate owner-approved action. Do not merge Intel/native prefixes.","source_ids":["T19"]
    },
    {
      "id":"python-zipfile","name":"Python standard-library zipfile","publisher":"Python Software Foundation","official_url":"https://docs.python.org/3/library/zipfile.html",
      "purpose":"Archive listing/integrity support through PatchCairn's bounded backup/export helpers, using an existing supported Python runtime.","supported_os":["windows","linux","macos"],"requirement":{"level":"required","when":"The selected portable helper requires supported Python 3.12+ and the needed archive modules; it is not a standalone universal backup tool."},
      "permission_scope":"Selected approved file reads and owned work output; never extract untrusted entries directly over installed/source/private locations.","privacy_limits":"Archive names/content can be private. Keep outputs in owned work and follow exact backup selection/restore checks. ZIP compression is not encryption; zipfile cannot create encrypted archives.",
      "version_check":{"method":"Identify the trusted interpreter and required standard-library capabilities without installing packages.","meaning":"Runtime/archive capability only; a valid ZIP/CRC alone is not verified backup contents, safe restore or application consistency."},
      "installation_owner_approval":"Use an existing supported runtime. Installing/upgrading Python or optional compression dependencies needs a separate concrete decision; preserve bundled/project interpreters.","source_ids":["T20"]
    },
    {
      "id":"seven-zip","name":"7-Zip","publisher":"Igor Pavlov / 7-Zip","official_url":"https://www.7-zip.org/",
      "purpose":"Optional local archive inspection or an explicitly approved archive workflow when native helpers cannot satisfy the selected format.","supported_os":["windows","linux","macos"],"requirement":{"level":"optional","when":"The selected official build supports the platform/format and the extra capability has a concrete benefit."},
      "permission_scope":"Current user and exact selected archive/output only; archive extraction is not authorized by listing consent.","privacy_limits":"Never open unrelated archives or extract escaping/link entries. Do not put passwords on command lines or upload archives; encryption requires its own supported owner decision.",
      "version_check":{"method":"Use an already-verified binary's documented version/About metadata and exact architecture/build.","meaning":"Archiver identity/capabilities only; archive testing does not prove safe contents, complete backup or malware clearance."},
      "installation_owner_approval":"Not required for ordinary assessment. Any download/install uses the official 7-zip.org ownership chain, artifact checks and explicit approved plan; no search-ad downloader.","source_ids":["T21"]
    },
    {
      "id":"git","name":"Git","publisher":"Git project / verified platform distributor","official_url":"https://git-scm.com/",
      "purpose":"Optional selected toolkit-source revision/diff verification and authorized publication preparation.","supported_os":["windows","linux","macos"],"requirement":{"level":"optional","when":"The owner selected repository/source work; ordinary host assessment needs no repository inspection."},
      "permission_scope":"Selected repository only; hooks/configuration/remote operations can execute or disclose data and need their actual scope reviewed.","privacy_limits":"No credential helper/config dumps, unrelated repository history or automatic remotes/push. Public identity/UTC publication requires the repository's separate reviewed procedure.",
      "version_check":{"method":"Use a trusted installed Git version query without opening another repository.","meaning":"Client version only; signed source/tag verification is a separate trust/provenance check."},
      "installation_owner_approval":"Use an existing verified installation. Install/update, identity/configuration changes, remotes and publication require their own concrete authority.","source_ids":["T22"]
    },
    {
      "id":"github-cli","name":"GitHub CLI (gh)","publisher":"GitHub","official_url":"https://cli.github.com/",
      "purpose":"Optional public upstream release/advisory metadata or explicitly authorized selected repository work.","supported_os":["windows","linux","macos"],"requirement":{"level":"optional","when":"An existing verified CLI and approved repository/API scope provide a concrete benefit over public web research."},
      "permission_scope":"Existing account/API grants are not action authority. Authenticated reads and all remote writes/publishing still require their intended scope; owner handles normal login.","privacy_limits":"Never print/read tokens, inspect authentication files, upload inventories/logs or create issues/PRs/messages as maintenance side effects. Prefer public research without an account connection.",
      "version_check":{"method":"Use current installed official help's benign version query; do not run a downloader or automatic extension.","meaning":"CLI version only; not account permission, upstream artifact provenance, or approval to publish."},
      "installation_owner_approval":"Not required for local maintenance. Installing/updating CLI, logging in, adding extensions or connecting a repository/account requires the appropriate separate decision.","source_ids":["T23"]
    },
    {
      "id":"codex-security-plugin","name":"Codex Security plugin","publisher":"OpenAI","official_url":"https://openai.com/business/plugins/codex-security/",
      "purpose":"Optional code/repository or diff vulnerability assessment when the owner separately selects that code scope.","supported_os":["host-dependent"],"requirement":{"level":"optional","when":"The actual assistant host has the plugin, suitable permissions/entitlement and an owner-authorized repository/code assessment."},
      "permission_scope":"Use the installed plugin's current skill/scan contract and available capabilities. Code scanning, validation, patches and external tracking have distinct scopes; installation is not permission to run them.","privacy_limits":"Scans can inspect code and produce sensitive source/finding artifacts and use model/service processing. Select scope and outputs, review data handling/charges, never supply host credentials or call it a whole-computer antivirus.",
      "version_check":{"method":"Inspect available installed plugin metadata/tool contract without invoking a scan or installing a package.","meaning":"Plugin/host capability only; findings have coverage limits and are not host malware, installed-software vulnerability or OS-integrity clearance."},
      "installation_owner_approval":"No scan/connection/install required for security-update mode. Explain actual or unknown entitlement/usage cost and obtain the separate code-scan or connection authority first.","source_ids":["T24"]
    },
    {
      "id":"windows-msiexec-local","name":"Windows Installer local MSI handoff (msiexec)","publisher":"Microsoft","official_url":"https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/msiexec",
      "purpose":"windows.msiexec.install: the coordinator invokes the official installer against the exact reviewed owned .msi path after the current fixed handoff gate; the service itself executes nothing.","supported_os":["windows"],"requirement":{"level":"required","when":"This exact implemented local-MSI update route is selected; target, package metadata, supported fixed argv and actual owner/OS consent all match."},
      "permission_scope":"Actual Windows Installer privileges and protected owner consent; no extra properties/transforms/options, arbitrary scripts or restart bypass. Package actions and installed data effects require exact review.","privacy_limits":"Consume only the ordinary single-link owned work artifact bound by native identity and SHA-256; recheck immediately before the official call. OS/vendor records can be outside work. No raw verbose-log upload or authentication data.",
      "version_check":{"method":"Use trusted installed help/OS metadata and selected MSI/vendor metadata to match product, publisher/signature, version, architecture, channel and installation scope.","meaning":"Installer and exact artifact/variant evidence only; completion, installed/active state, behavior and security remediation remain separate. Fixed no-restart behavior does not prove activation complete."},
      "installation_owner_approval":"Requires the exact reviewed action and actual owner/OS consent. Existing installer presence grants no authority; unknown package actions, changed bytes/identity or unsupported variant hold without force/fallback.","source_ids":["T25","T26","T07"]
    },
    {
      "id":"macos-installer-local","name":"Apple local PKG Installer and pkgutil signature inspection","publisher":"Apple","official_url":"https://help.apple.com/xcode/mac/current/en.lproj/dev16fb2b911.html",
      "purpose":"macos.installer.pkg: the coordinator invokes Apple's installer on the exact reviewed owned .pkg path after the current fixed handoff gate. pkgutil checks the package signature; codesign of embedded code is a different observation.","supported_os":["macos"],"requirement":{"level":"required","when":"This exact implemented local-PKG update route is selected and current installed installer/pkgutil manuals, fixed target/argv and native capabilities are established."},
      "permission_scope":"Normal installer privilege and actual protected owner consent; no extra args, policy override, package substitution or unapproved target/restart. Publisher scripts and installed effects remain part of the reviewed action.","privacy_limits":"Use only the ordinary single-link owned work package, exact native identity/SHA-256 and selected signer/variant evidence. No Keychain/authentication reads or full install-log dump; Apple/OS receipts can remain outside work.",
      "version_check":{"method":"Check installed man installer/man pkgutil or supported help on the actual Mac, then match package publisher/signature, exact version/architecture/channel/scope and target to approved evidence.","meaning":"Tool/package provenance and capability only. Web manual access attempts returned 404; official pkgutil article text was available through research search. No native Mac validation or package execution is claimed."},
      "installation_owner_approval":"Use existing Apple tools only after exact owner/OS authority and the fixed service gate. Signature/target/identity drift or unavailable required current manual/policy evidence holds; never disable Gatekeeper or use codesign as PKG proof.","source_ids":["T27","T28","T29","T30","T18"]
    },
    {
      "id":"linux-dpkg-local","name":"dpkg local DEB installation handoff","publisher":"Debian dpkg maintainers / distribution maintainer","official_url":"https://manpages.debian.org/stable/dpkg/dpkg.1.en.html",
      "purpose":"linux.dpkg.install_local: the coordinator invokes the official distribution dpkg against the exact reviewed owned .deb path after the current fixed handoff gate; the service is not an executor.","supported_os":["linux"],"requirement":{"level":"required","when":"A supported dpkg-owned update uses this exact implemented local-artifact route, with compatible dependency/variant state and verified official distribution provenance."},
      "permission_scope":"Actual package-install privilege and protected owner consent. Fixed argv only, no force/recursive/configure-all or automatic dependency-repair fallback; package maintainer scripts can run and must be reviewed as effects.","privacy_limits":"Bind the ordinary single-link owned work .deb by native identity/SHA-256 and exact version/architecture/channel/publisher/source. Verify its checksum through authenticated signed repository metadata; no source/key changes, auth reads or raw transaction-log upload.",
      "version_check":{"method":"Check trusted installed dpkg help/version, selected package metadata and the official signed Release-to-Packages-to-artifact checksum chain for this distribution/branch.","meaning":"Local package identity/provenance only; dpkg install is not a per-package publisher-signature verifier or an automatic dependency resolver. Missing dependencies or partial configuration remain failed/partial outcomes, not permission for a repair loop."},
      "installation_owner_approval":"Exact reviewed update and actual owner/OS consent required. Unauthenticated checksum/publisher, changed artifact, unsupported dependencies or unavailable native capability hold without package-manager substitution or forced install.","source_ids":["T31","T32"]
    }
  ]
}