Policy Mapping Summary¶

EXISTING_ENFORCEMENT (4)¶

authority/agent-team.md: 28. Final operating law: ```text THOMAS SETS INTENT. BLU RUNS THE FACTORY. MAYOR RUNS ORACLE. BE...
rules/git-completion-contract.md: Axiom: ```text FEATURE_BEAD_CLOSES_AFTER_RELEASE_INTEGRATION=YES FEATURE_BEAD_WAITS_FOR_MAIN=NO ...
standards/gas-city/gascity-worker-contract.md: Required final receipt: ``` EXECUTED OpenClaw PASS/FAIL Gas City PASS/FAIL Beads PASS/FAIL Legac...
tools/nas-archivist/design.md: Governance Gate (gt-policy): Status: NO ACTIVE BEAD...

Runtime/Upstream-Capability-Discovery.md: Binding SHALL: When a Business Requirement implies software work against an upstream surface, en...
architecture/README.md: Scope: If a document is prescriptive ("MUST", "REQUIRED", "Refuse install when...") it belongs i...
architecture/README.md: Subdirectories: ddev/ — ddev-architecture.md (Bluefly's DDEV distribution model: ownersh...
architecture/oracle-architecture.md: Storage Class Division & Lifecycle Law: RULE: NEVER run hot .gc/worktrees, SQLite, or Dolt over ...
architecture/platform-boundaries.md: CI/CD Boundary Rule: Every Bluefly repository's .gitlab-ci.yml MUST:...
... and 145 more.

authority/agent-team.md: 3. Thomas is not the factory: ```text THOMAS_IS_MESSAGE_BUS=NO THOMAS_IS_SHELL_OPERATOR=NO THOMA...
decision-records/ADR-0005-evaluator-pattern-for-governance.md: Rule: It must NEVER recommend, schedule, or execute data mutation (e.g. deleting files, archivin...
standards/core/authentication-secrets-constitution.md: 22.3 Launcher rule: tokens travel by file or inherited environment, never by argv: Every process...
standards/core/contrib-first-policy.md: "Contrib First" — The Law of Reuse: ============================================================...
standards/core/execution-receipt-specification.md: Conformance: all REQUIRED sections are present in canonical order,...
... and 7 more.

architecture/oracle-architecture.md: Dedicated Block Volume Mount (/opt/bluefly/ or /srv/gascity/bluefly): ```text /opt/bluefly/ ...
catalog/gitlab-service-accounts.md: Purpose: Every autonomous agent that interacts with GitLab — creating MRs, pushing commits, trig...
catalog/gitlab-service-accounts.md: R4 — Least-Privilege Scope: Each service account token MUST be scoped to exactly the permissions...
catalog/gitlab-service-accounts.md: R8 — No Force Push on Shared Branches: Service account tokens MUST be configured with protected ...
glossary/platform-glossary.md: OSSA / DUADP / Gas City / Drupal Layering (operator doctrine, routed via Forge, 2026-08-24): **D...
... and 8 more.

architecture/gas-city-governance-pack-architecture.md: Governance Convergence — Phase 4: Gas City Pack Structure Design: > Prerequisite: [Phase 1 I...
catalog/gitlab-service-accounts.md: R6 — Git Author vs. Authentication: Git author metadata (user.name, user.email) MUST reflect...
context-plane/opencode-operating-model.md: 5. Portability & Path Isolation (GOV-PATH-PRIV-001): All OpenCode configuration files, agent pro...
infrastructure/configuration-compiler-v1.0.md: 1. Architectural Invariants: Configuration Compiler is Runtime-Agnostic. It produces *artifa...
operating-model/blu-identity.md: 13. Epistemic Evidence Law: ```text ============================================================...
... and 13 more.

authority/agent-team.md: 2. Permanent authority model: Mac worktree root: see [git-discipline.md](../standards/core/git-d...
authority/agent-team.md: 22. Scratch / worktree / deletion: ```text SCRATCH_ROOT=[WORKSPACE-ROOT]/Scratch WORKTREE_ROOT=[...
authority/agent-team.md: 24. Security / identity / evidence: ```text AUTHENTICATE ONCE REFERENCE SECRETS REUSE AUTHORITY ...
decision-records/ADR-0020-bluefly-authentication-and-secrets-constitution.md: 1. Prime Directive: AUTHENTICATE_ONCE=YES DO_NOT_WRAP_EVERY_CALL=YES `SECRET_VALUES_IN_CHAT=...
decision-records/ADR-0020-bluefly-authentication-and-secrets-constitution.md: 20. Constitutional Invariants: SECRET_VALUES_IN_SOURCE=NEVER...
... and 75 more.