Inventory and baseline
Configuration items, owners, baseline settings, and source-tracked configuration records must exist before configuration claims expand.
Baselines, Checklists, Drift Planning, and Non-Claims
Secure configuration and change management
Latticra records configuration inventory, secure baseline, checklist, approved-change, rollback, drift-detection, and exception requirements before hosted services, production installers, production runtime, infrastructure automation, or hardening claims can promote. It does not mutate host configuration, enforce settings, scan systems, detect drift, approve changes, execute rollback, or claim compliance.
Current Rule
Configuration records are not hardening.
The baseline names the evidence a future configuration-capable lane would need: configuration item inventory, baseline settings, secure-default review, checklist evidence, change owner, risk review, test evidence, rollback plan, drift-detection plan, secret review, logging, exception owner, exception expiration, and operator-visible non-claims.
Secure defaults and checklists
Secure-default review, checklist evidence, default-credential absence, and insecure-default absence are required promotion fields.
Change control and rollback
Approved changes need an owner, request record, risk review, test evidence, rollback plan, and visible non-claim boundary.
Drift, secrets, and exceptions
Drift planning, configuration secret review, event logging, exception owner, and exception expiration must be recorded.
Current Snapshot
The baseline blocks configuration claims until evidence exists.
These fields describe required records and closed behavior. They are not proof of hardening, scanning, enforcement, drift detection, infrastructure automation, host mutation, or production configuration authority.
Promotion Gate
No hardening wording can promote without change evidence.
Configuration language touches installer, runtime, hosted-service, infrastructure, and compliance expectations. The current record keeps that language precise: baseline evidence can be discussed, but production configuration behavior remains closed.
Present now
Baseline record, status record, guard script, high-assurance allocation, supply-chain context, logging context, vulnerability-management context, installer config authority allowlist guard, installer UI artifact guard, and metadata-only configuration posture.
Required before promotion
Configuration item inventory, owner record, baseline configuration, checklist evidence, secure-default review, default-credential absence, insecure-default absence, change request, change owner, risk review, test evidence, rollback plan, drift-detection plan, secret review, configuration log event, exception owner, exception expiration, and operator-visible non-claims.
Denied now
Host configuration changes, production configuration claims, secure-default claims, hardening claims, scanning claims, enforcement, drift-detection claims, hosted-service configuration claims, infrastructure-as-code claims, compliance claims, and rollback execution.
Latticra Boundary
Configuration records remain no-effect metadata.
Latticra can record configuration requirements, authority allowlists, and UI artifact boundaries. It does not grant configuration authority, mutate hosts, enforce settings, scan configuration, detect drift, or run a change-approval workflow.
Configuration baseline
Baseline settings and checklists are planning records, not host-hardening actions.
Installer authority
The installer config authority allowlist is guarded before any future authority expansion.
UI artifact authority
Installer UI artifact authority remains source-bound and checked against fixture expectations.
Configuration runtime
No host mutation, infrastructure mutation, enforcement, scanning, drift detection, rollback execution, or configuration authority is added.
Local Commands
Validate configuration records without changing systems.
These checks validate source records, status alignment, and installer authority boundaries. They do not apply host settings, scan configuration, approve changes, detect drift, or execute rollback.
Configuration baseline
sh scripts/test-secure-configuration-change-management-baseline.shInstaller authority guards
sh scripts/test-installer-config-authority-allowlist.sh
sh scripts/test-installer-ui-artifact-authority.shSecurity context
sh scripts/test-high-assurance-security-baseline.sh
sh scripts/test-security-logging-monitoring-baseline.shSource Records
Use exact records before repeating configuration wording.
Secure configuration and change management baselineConfiguration inventory, secure baselines, checklists, approved changes, rollback planning, drift detection, exceptions, and no hardening claims.
Configuration baseline statusStatus fields and expected guard output for the secure configuration and change-management baseline.
High-assurance baselineSource-tracked security posture and secure configuration control allocation.
Supply-chain baselineInstaller config authority allowlist, release blockers, update gates, and non-claim context.
Security logging baselineConfiguration change logging, event-source inventory, redaction, retention, and monitoring non-claims.
Vulnerability management baselineRelease blocking, KEV/NVD review, exception records, and product-security non-claims.
C/C++ security profileDefault credential, token, private key, and secure coding expectations.
Security overviewSafe testing, effect gates, runtime boundary, and security non-claims.
Supply-chain gatesReader-facing release authority, SBOM, updater, runtime-authority, and production security blockers.
Network exposure and remote accessNetwork inventory, ingress/egress policy, remote access, RMM, DNS/TLS lifecycle, and no network-service claims.
Data classification and protectionConfiguration secret review, data classification, redaction, retention, and customer-data non-claims.
Security logging and monitoringConfiguration-change logging context, audit events, redaction, retention, and no detection-service claims.
Vulnerability management gateKEV/NVD review, exception records, release blockers, and product-security non-claims.
Installer readinessInstaller configuration authority boundaries, local artifact manifest fixture, and production installer non-claims.
Evidence modelPromotion levels, public claim boundaries, and exact source records.
Status indexDetailed status records and current public status navigation.