Skip to content

docs: add OSOH MVP build slice 01 #30

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Raulsalvatestebaranz merged 1 commit into from
Mar 7, 2026
Merged

docs: add OSOH MVP build slice 01 #30

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
51 changes: 51 additions & 0 deletions docs/tasks/OSOH_MVP_BUILD_SLICE_01.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,51 @@
# OSOH MVP Build Slice 01

## Slice Goal
Establish the first implementation slice for the OSOH MVP by defining the minimum build path that should be completed first before broader feature expansion.

## Slice Scope
This slice covers:
- monitored surface registration foundation
- enforced `external_monitored_surface` classification
- unique ingest-only credential issuance foundation
- initial ingest endpoint baseline
- fail-closed activation prerequisites

## Required First Build Order

### 1. Persistence foundation
- create `monitored_sites`
- create `monitored_surface_tokens`
- create minimal state fields required for registration, classification, and activation status

### 2. Registration and classification foundation
- add monitored site creation path
- persist site identity
- enforce classification as `external_monitored_surface`
- reject any path that implies OSOH core promotion

### 3. Token foundation
- issue one unique ingest-only credential per monitored surface
- bind credential to one site only
- prevent shared or privileged credential scope

### 4. Ingest baseline
- create `POST /v1/monitoring/ingest`
- require bearer-token authentication
- validate minimal payload structure
- reject invalid or out-of-scope submissions

### 5. Activation gate
- keep site inactive by default
- require verification before activation
- preserve fail-closed behavior for missing or invalid proof

## Slice Completion Condition
Slice 01 is complete when Sentinel can be represented inside OSOH as a registered external monitored surface with one unique ingest-only credential and a working ingest baseline, while still remaining inactive until verification is proven.

## Non-Negotiables
- Sentinel remains `external_monitored_surface`
- Sentinel does not become OSOH core
- Sentinel does not enter first-party session trust
- Sentinel does not enter broad first-party CORS trust
- ingest credentials remain ingestion-only