docs: connect CASTÚO governance boundary

.github/workflows/castuo-v1-repository-conformance.yml

@@ -0,0 +1,58 @@
+name: CASTUO V1 repository conformance
+
+on:
+  pull_request:
+  push:
+    branches: [main, master]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  repository-conformance:
+    name: repository-conformance-local-scope
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Validate declared CASTUO V1 metadata
+        shell: bash
+        run: |
+          set -euo pipefail
+          test -f repository.yaml
+          test -f governance/castuo-standard-reference.yaml
+          grep -q 'metadata_source: CASTUO-REPOSITORY-STANDARD-V1.0' repository.yaml
+          grep -q 'current_state:' repository.yaml
+          grep -q 'evidence_state:' repository.yaml
+          grep -q 'production_claim: NOT_CLAIMED' repository.yaml
+          grep -q 'promotion_state: PROMOTION_BLOCKED' repository.yaml
+          grep -q 'standard_id: CASTUO-REPOSITORY-STANDARD-V1.0' governance/castuo-standard-reference.yaml
+          grep -q 'reference_mode: CANONICAL_REFERENCE_NOT_COPY' governance/castuo-standard-reference.yaml
+          grep -q 'production: NOT_CLAIMED' governance/castuo-standard-reference.yaml
+          grep -q 'promotion: BLOCKED_UNTIL_LOCAL_SCOPE_EVIDENCE' governance/castuo-standard-reference.yaml
+
+      - name: Emit bounded conformance result
+        shell: bash
+        run: |
+          set -euo pipefail
+          mkdir -p artifacts/castuo-conformance
+          cat > artifacts/castuo-conformance/result.json <<'JSON'
+          {
+            "standard": "CASTUO-REPOSITORY-STANDARD-V1.0",
+            "scope": "repository metadata and canonical reference only",
+            "status": "PASS",
+            "production": "NOT_CLAIMED",
+            "promotion": "BLOCKED_UNTIL_LOCAL_SCOPE_EVIDENCE",
+            "identity_is_evidence": false,
+            "local_conformance_is_remote_truth": false
+          }
+          JSON
+
+      - name: Upload bounded conformance artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: castuo-v1-repository-conformance
+          path: artifacts/castuo-conformance/result.json

README.md

@@ -99,3 +99,53 @@ Offline operation uses device identity, encrypted local buffering, an idempotent
 This repository is part of the CASTÚO-SYSTEM private-cloud target architecture. Its repository scope does not by itself prove cloud provisioning, DNS, production operation, customer traction, financing, certification or independent validation. The service identity is a governed target boundary until a deployment record, access control, health check, observability, backup, restore, rollback, owner and dated Evidence Center record are published.
 
 The public state model is `DOCUMENTED` → `IMPLEMENTED_LOCAL` → `TESTED` → `VALIDATED` → `OPERATIONAL`. OpenClaw and n8n, where referenced, are optional compatibility adapters and not the sovereign governance control plane.\n
+
+<!-- CASTUO:PUBLIC-SURFACE -->
+## CASTÚO integration boundary
+
+This repository exposes only a bounded public integration surface. Its role, current state and claims are subordinate to the `Traky12/castuo-evolution` control plane.
+
+This repository does not by itself claim production operation, certification, independent validation, customer contracts, revenue, autonomous authority, global federation or legal compliance. Do not publish secrets, credentials, private endpoints, customer data, private evidence or unpublished security findings.
+
+See [`docs/CASTUO_PUBLIC_SURFACE.md`](docs/CASTUO_PUBLIC_SURFACE.md) for the public boundary. `Claim != Evidence`; `CURRENT != TARGET`; promotion requires control-plane authorization.
+<!-- CASTUO:PUBLIC-SURFACE-END -->
+
+<!-- CASTUO:PUBLIC-GOVERNANCE:START -->
+## CASTÚO-SYSTEM governed public surface
+
+**Repository role:** `EDGE / IOT`<br>
+**Scope statement:** Offline continuity, edge sensing and synchronization concepts within declared scope.
+**Public state:** `EVIDENCE-SCOPED · STAGING-CANDIDATE · PROMOTION-BLOCKED`
+
+This repository is a governed surface of CASTÚO-SYSTEM. The canonical governance source is [`castuo-evolution`](https://github.com/Traky12/castuo-evolution); the public Knowledge & Evidence Index is a read-model. Repository activity, a README, commit, pull request or passing local workflow does not by itself establish remote operation, production, certification, customers, revenue or regulatory conformity.
+
+**Boundary:** Edge capability / pilot evidence pending.
+
+| Layer | Public meaning |
+|---|---|
+| Documented | Scope, design or policy is described. |
+| Implemented local | Implementation exists within declared local scope. |
+| Tested local | A local test passed within its declared scope. |
+| Evidence-scoped | Evidence surfaces and limitations are identified. |
+| Operational / production | `NOT_CLAIMED` unless separately evidenced and reviewed. |
+
+For public navigation use the [Traky12 profile](https://github.com/Traky12/Traky12), the [Evidence Center](https://github.com/Traky12/Traky12/tree/proof-matrix-profile/docs/evidence) and the [Public Knowledge & Evidence Index](https://castuo-system.es/).
+
+`Identity != Documentation != Evidence != Execution != Review != Promotion`
+<!-- CASTUO:PUBLIC-GOVERNANCE:END -->
+
+## CASTÚO-SYSTEM public governance boundary
+
+**Role / Rol:** `EDGE / RUNTIME`
+
+> NO CLAIM WITHOUT PROVENANCE.
+>
+> NINGÚN CLAIM SIN PROVENIENCIA.
+
+This repository covers edge-oriented capability work. Runtime activity does not equal operational truth without an evidence envelope and review.
+
+Este repositorio cubre capacidades orientadas a edge. La actividad del runtime no equivale a verdad operativa sin envelope de evidencia y revisión.
+
+The canonical meaning and promotion rules remain in [`castuo-evolution`](https://github.com/Traky12/castuo-evolution). The public profile is a read-model; this repository does not authorize promotion. Public state remains `EVIDENCE-SCOPED · STAGING-CANDIDATE · PROMOTION-BLOCKED` unless a newer source snapshot explicitly proves otherwise.
+
+La semántica canónica y las reglas de promoción permanecen en [`castuo-evolution`](https://github.com/Traky12/castuo-evolution). El perfil público es un read-model; este repositorio no autoriza la promoción. El estado público permanece `EVIDENCE-SCOPED · STAGING-CANDIDATE · PROMOTION-BLOCKED` salvo que un snapshot posterior lo demuestre explícitamente.

docs/CASTUO_PUBLIC_SURFACE.md

@@ -0,0 +1,23 @@
+# CASTÚO Public Surface Boundary
+
+This repository is a bounded public surface of CASTÚO. Its role and any public state are subordinate to the `castuo-evolution` control plane.
+
+## Publicly allowed
+
+The repository may expose its bounded role, documented capability, reproducibility instructions that require no secrets, approved public evidence and a claims boundary.
+
+## Not claimed
+
+This repository does not by itself prove production operation, certification, independent validation, continuous operation, customer contracts, revenue, field KPIs, autonomous authority, global federation or legal compliance.
+
+## Security boundary
+
+Do not publish secrets, credentials, private endpoints, customer data, personal data, private evidence, internal diagnostics or unpublished security findings. Follow this repository's `SECURITY.md` where available and report vulnerabilities through the documented disclosure process.
+
+## Governance rule
+
+`Claim != Evidence`. `CURRENT != TARGET`. A green workflow or repository artifact proves only its declared scope. Public claim promotion requires control-plane authorization and human review where configured.
+
+## Control plane
+
+The authoritative governance source is the private `Traky12/castuo-evolution` repository. This file is explanatory only and must not be used to promote repository state manually.

governance/castuo-standard-reference.yaml

@@ -0,0 +1,11 @@
+standard_id: CASTUO-REPOSITORY-STANDARD-V1.0
+version: "1.0"
+canonical_repository: Traky12/castuo-evolution
+canonical_path: docs/CASTUO-REPOSITORY-STANDARD-V1.0.md
+vocabulary_source: Traky12/castuo-evolution/governance/master-vocabulary.yaml
+annex_source: Traky12/castuo-evolution/docs/standard-v1.0/
+control_plane: castuo-evolution
+reference_mode: CANONICAL_REFERENCE_NOT_COPY
+validation: castuo-evolution/scripts/validate_repository_conformance.py
+production: NOT_CLAIMED
+promotion: BLOCKED_UNTIL_LOCAL_SCOPE_EVIDENCE

repository.yaml

@@ -0,0 +1,42 @@
+id: CASTUO-REPOSITORY-CASTUO_AGRO_EDGE
+name: castuo-agro-edge
+class: EDGE
+visibility: PUBLIC
+owner: Traky12
+parent_system: CASTUO-SYSTEM
+lifecycle: ACTIVE
+scope: offline-first rural edge and IoT continuity
+current_state: CANDIDATE
+assurance_level: L0_CONTRACT_DEFINED
+evidence_state: EVIDENCE_PENDING
+production_claim: NOT_CLAIMED
+relationships:
+  upstream: [Castuo-system]
+  downstream: []
+  peers: []
+claims_blocked:
+  - production
+  - certification
+  - independent_validation
+  - autonomous_authority
+  - commercial_validation
+  - federation
+metadata_source: CASTUO-REPOSITORY-STANDARD-V1.0
+repository: castuo-agro-edge
+purpose: offline-first rural edge and IoT continuity
+environment: STAGING
+implementation_state: CANDIDATE
+security_state: EVIDENCE_PENDING
+promotion_state: PROMOTION_BLOCKED
+claims_allowed:
+  - documented repository role within declared scope
+claims_blocked:
+  - production
+  - certification
+  - independent_validation
+  - autonomous_authority
+  - commercial_validation
+  - federation
+dependencies: []
+upstream: [Castuo-system]
+downstream: []