Index Management

The root index.json is the canonical management contract for tools, maintainers, and agents; content files remain the evidence-bearing source material.

What The Contract Controls

• Identity: name, slug, description, owner, and visibility.
• Content boundaries: approved roots and directories that discovery must ignore.
• Registries: explicit repository, service, and workspace sources, or null when absent.
• Lifecycle: status, last evidence review, review cadence, and stale threshold.
• Interfaces: whether docs, MCP, and optional Slack access are enabled and whether access is read-only, protected, or disabled.

The MCP server reads these boundaries instead of assuming every Markdown file is publishable. Paths must remain inside the repository.

Review Workflow

1. Update index.json when ownership, visibility, roots, registries, or interfaces change.
2. Verify changed facts against links, files, commands, or other inspectable evidence.
3. Run npm run validate:index and the checks for the affected surface.
4. Update management.lastReviewed only after that evidence review is complete.
5. Mark dormant indexes maintenance or archived; do not keep stale material implicitly active.

Safety Boundary

management.secretsPolicy is fixed to references-only. Store secret references or environment variable names, never tokens, credentials, private keys, or copied production data. Keep exposed interfaces read-only and use protected access for restricted workspaces.