🌞 MADFAM: The Solarpunk Foundry

Last updated: 2026年09月04日 — reconciliation edition. No new probes were run; the verification anchors below are unchanged, and every claim was re-checked against them. Verification anchors — every status claim below inherits one of these dates, and each section says which:

• Repo names, visibility, and roles: internal-devops/ecosystem/repo-registry.md, Last Verified 2026年08月24日 (live GitHub enumeration including forks), Last Updated 2026年08月29日 (one repo added after the enumeration). Org counts restated in §II.7.
• Production routes and domains: internal-devops/ecosystem/domain-map.md, Last Verified 2026年08月24日 — a full live HTTP probe of every routed domain run for that refresh (the Cloudflare tunnel ingress API was last re-read 2026年07月01日; rows added since carry enclii.yaml-sourced service/port values).
• Funnel / commercial status: the 2026年07月16日 internal launch-readiness audit, plus the dated events that superseded parts of it — first completed live charge 2026年08月02日 (§VI) — and the 2026年08月14日 internal sovereign-pivot audit.
• Cross-repo conventions: dates stated per convention in §IV.

This document contains no independent probes of its own; route claims inherit the 2026年08月24日 live-probe verification of the private domain map. Where a claim is documented but unverified, or aspirational, it says so.

• Organization: Innovaciones MADFAM S.A.S. de C.V. (Cuernavaca, Morelos, MX)
• Canonical domain: madfam.io
• GitHub: madfam-org
• Status board: status.madfam.io — the only surface that reports live up/down state. This repo does not.

solarpunk-foundry is the designated public ecosystem contract repo for MADFAM (internal-devops/docs/repo-boundary-contract.md, last updated 2026年06月14日). It holds:

• the canonical ecosystem map at a platform-public level (§II);
• the cross-repo conventions a platform implements, or else does not participate (§IV);
• the @madfam/* shared packages (packages/, §VIII);
• local dogfooding scaffolds (ops/, §VII);
• sanitized architecture narrative and redacted pointers into the private repo.

The operational source of truth is the private internal-devops repo. It is the only allowed home for node identity, IPs, hardware and capacity figures, cost ledgers, secret paths, incident internals, break-glass procedures, and the authoritative domain map and repo registry. That repo exists because a 2026年03月13日 audit found sensitive operational data spread across 18 public repositories.

Concretely: this repo can tell you that ingress is a single Cloudflare Tunnel with zero exposed node ports. It cannot tell you the tunnel's name or ID, the node hostnames, or what any of it costs — and it must not.

Policy: internal-devops/docs/repo-boundary-contract.md. Public-repo enforcement checklist: docs/PUBLIC_REPO_BOUNDARY.md.

1. §0–§II here — what this repo is, and the platform map.
2. §IV here — the five cross-repo conventions. If you are building a service, these are the ones that will reject your work if you break them.
3. ECOSYSTEM.md — the standalone, agent-oriented ecosystem map + Enclii CLI reference.
4. docs/architecture/SYMBIOSIS.md — the Substrate · Trellis · Membrane platform-relationship contract.
5. docs/PORT_ALLOCATION.md — the port scheme, and an honest account of how little of it is followed. Read this before assuming any port number in any doc.
6. MADFAM.md — the fuller per-platform master reference.
7. packages/*/README.md — the concrete shared surfaces.

Agents: start at AGENTS.md, which is canonical for LLM agents in this repo. CLAUDE.md is a compatibility redirect only.

"Sovereignty is not just about owning your server; it's about owning your supply chain, your money, and your mind."

MADFAM is a vertically-integrated venture studio operating at the seam between the digital (software) and the physical (fabrication, finance, and compliance), with a LATAM-first, Mexico-rooted posture.

A founder is a tenant in their own business: renting design tools, cloud, audience, payment rails, and compliance infrastructure. A change in API pricing, a platform ban, a SAT reform, or a venture cycle can end a business.

A closed-loop ecosystem where each tool supports the others. Every layer can be swapped for a competitor without toppling the rest — but because every layer is ours, the economics compound inside the loop. The tools run our own operations first ("Primavera Mandate", §III) and only then face outward.

This section is positioning, not a status claim. For where the ecosystem actually stands, see §VI.

Sources and dates. Repo names, visibility and roles follow internal-devops/ecosystem/repo-registry.md (Last Verified 2026年08月24日, live GitHub enumeration). Domains follow internal-devops/ecosystem/domain-map.md (Last Verified 2026年08月24日, live HTTP probes of every routed domain); rows with a different verification date say so inline.

Visibility. 🔒 marks a repo that is private — its github.com/madfam-org/... link will 404 without org access. Visibility re-checked against the GitHub API on 2026年08月24日.

"Live" below means the route answered at its last recorded probe on the date given — not that it is answering now, and not that the product behind it is feature-complete.

Standing route warnings (domain-map.md, verified 2026年07月01日):

• agents-*.madfam.io and selva.madfam.io are retired — no tunnel ingress rules, they return 502. Do not resurrect them.
• auth.selva.town must never be routed. Janua is single-issuer per deployment (the issuer is derived from JANUA_CUSTOM_DOMAIN, not the request Host), so serving Janua there would emit issuer=auth.madfam.io and break OIDC validation. Selva SSO uses auth.madfam.io (selva-office#195).
• metrics.enclii.dev is a retired alias with no DNS or tunnel route. The canonical endpoint is prometheus.enclii.dev.
• innovacionesmadfam.dev was never owned (owner confirmation 2026年07月09日). Do not reference it — including any security@ address on it. The company domain is madfam.io.
• madfam.academy and madfam.info are expired.

madfam-site (madfam.io, cms.madfam.io) · primavera3d (primavera3d.pro, our in-house factory portfolio) · ceq (ceq.lol, ComfyUI wrapper) · nuit-one (nuit.one) · subtext (subtext.live) · accionables-madlab (madlab.quest) · server-auction-tracker (sniper.madfam.io, Hetzner auction intelligence) · selva-sandbox · kinship (E2E-encrypted community logistics) · panopticon-mx (Mexican state-structure atlas; Tezca integration path) · electrochem-sim (recorded stale since 2025-11) · dhanam-core (AGPLv3 open core extracted from Dhanam, created 2026年07月20日) · coupler (MADFAM Agent Tool Plane — delegated SaaS tools, MCP, sandbox, triggers; AGPL-3.0; registry records Phase 2 and very active) · eido (live — see the note below) · meridian (see below).

factlas (geospatial facts, factl.as / factlas.com) · gh-backups · proton-bridge-pipeline · symbiosis-hcm (Mexican payroll — ISR, IMSS, INFONAVIT, ISN — plus employees, time-off and recruiting; human-facing surfaces live since 2026年08月04日. ONA, wellbeing and Shapley compensation are empty package stubs, not shipped features) · lexidrop (domain-acquisition intelligence; created 2026年08月25日, live at ld.madfam.io) · tulana (internal pricing intelligence; deployed, Janua-gated) · converge-dash (executive metrics layer; rollout blocked) · turnbased-engine + stratum-tcg + tablaco family (tablaco, tablaco-v2, tablaco-tabletop) + arcanic-rosetta + madfam-baraja (the games cluster) · zavlo (financial-ops engine; Karafiel integration path) · periplo (route-collector app; DNS still NXDOMAIN — not live, re-confirmed 2026年08月24日) · hyperobjects-spec (verification keystone for the hyperobjects class — schemas, sandbox, conformance runners consumed by Yantra4D and Fashion Cabinet) · migration-platform (website-migration platform; first adapter migrates Wix sites onto Enclii) · marca (short-links / QR; onboarding in flight, not yet live) · angelia (omnichannel messaging; substrate work only — no product yet) · avala-content (authored course content, kept separate from the AVALA platform) · client-site-starter + enclii-onboard-kit (client-delivery tooling).

Client-engagement repos are deliberately not mapped here. A small number of private repos hold client-owned IP under contract; they are counted in §II.7's totals but excluded from this public map by policy (internal-devops/docs/repo-boundary-contract.md).

• meridian (public, AGPL-3.0) — global migration law and logistics: pathway rules engine, ICAO 9303 travel-document validation, cross-border presence/tax day counting, document legalisation routing. Partially live: meridian.madfam.io (landing), meridian-app. and meridian-admin. all serve real content; meridian-api. answers 502 — the backend is not up. Earlier editions said "not deployed, no DNS" — that is no longer true. Unchanged and still decisive: no pathway has been counsel-reviewed, which blocks all advice-class output by design. Hostnames are deliberately flat, not nested, because Cloudflare universal SSL covers *.madfam.io but not *.*.madfam.io.
• eido — live. eido.cam serves the product ("Capture Reality. Command Form.") and api.eido.cam/health returns 200 (probed 2026年08月24日). This settles the contradiction earlier editions carried between same-day internal records: the go-live records were right.
• periplo — still not live: repo private and populated, and the platform's Argo application exists, but periplo.madfam.io is NXDOMAIN (re-confirmed 2026年08月24日) — the route was never provisioned.

Intended to fold into an existing platform rather than exist standalone: zavlo → Karafiel, panopticon-mx → Tezca. Completed: social-sentiment-monitor → Fortuna (archived 2026年05月03日, absorbed per RFC 0016 — Perception Index and anomaly detector ported to Fortuna, IG/YT/TT collectors moved to madfam-crawler). penny was listed as a selva-office integration path; the repo is archived as of the 2026年07月25日 live check.

116 repos, of which 3 are forks (gridfinity_extended_openscad, claudecodeui, Auto-Claude). Excluding forks: 113 repos = 44 private + 69 public, with 8 archived (aureo-labs, ecosystem-banner, legal-ops, penny, sim4d, slide-holder, social-sentiment-monitor, yapp-box) plus the archived claudecodeui fork.

The base is a live GraphQL enumeration run on 2026年08月24日 (115 total; 112 non-fork = 43 private + 69 public), incremented by one private repo — lexidrop, created 2026年08月25日, after that enumeration, so a genuine new repo rather than an enumeration miss.

Reconciliation against this document's previous enumeration (2026年07月25日: 96 non-fork = 27 private + 69 public): +16 non-fork repos, all private, all created between 2026年08月04日 and 2026年08月22日 — the vCTO/client-delivery cluster, new platforms (Kalya, Acervo, Marca, Angelia, Fashion Cabinet, hyperobjects-spec, migration-platform), and the games cluster. Public count unchanged at 69, with two archive flips inside it: sim4d archived (by 2026年08月07日) and cq-hyperobject-test un-archived (active again since 2026年08月22日).

The private repo-registry.md was rebuilt from this same enumeration on 2026年08月24日, so for the first time since 2026年07月04日 the registry and the live org agree. The corrections earlier editions of this section carried against the registry (fork "deletions", understated archive count, missing rows) are now folded into it.

This public doc keeps counts and public-safe roles only. The authoritative per-repo registry lives in internal-devops/ecosystem/repo-registry.md (Last Verified 2026年08月24日).

"We trust it because we survive on it."

We build tools to run our own operations first, then face outward once they have survived contact with us.

This is the mandate, i.e. intent. It is not a claim that each row is currently exercised in production; §VI records where the commercial loop actually stands.

These are the load-bearing contracts. A platform implements them the same way or it does not participate. Each carries the date of the newest source that establishes it.

Every authenticated service verifies Janua JWTs against the JWKS at https://auth.madfam.io/.well-known/jwks.json. RS256 only — HS256 is fail-closed since the 2026年04月23日 ecosystem audit (findings H3/H4, which found symmetric-secret verification in live service code). No service implements custom auth, password login, or session management.

Available claims: sub, email, roles, org_id, and rfc (fiscal services only).

Janua is single-issuer per deployment: the issuer is derived from JANUA_CUSTOM_DOMAIN, not the request Host. A second Janua hostname cannot be served without breaking OIDC validation — this is why auth.selva.town must never be routed.

Convention source: 2026年04月23日 audit + internal-devops/ECOSYSTEM.md. Conformance is not uniform. The 2026年07月16日 launch-readiness audit rates the janua-SSO-matrix edge YELLOW, not green. Per-surface enforcement is tracked privately; the matrix that recorded it is noted in internal-devops as a session artifact not committed to the repo, so per-surface SSO status is currently unestablished. Committing that matrix and citing it by path would settle it.

Credit metering, entitlements, invoices and the billing ledger flow through Dhanam (madfam-org/dhanam). Other services read via API and keep no local mirror.

Convention source: internal-devops/ecosystem/repo-registry.md + this repo's ECOSYSTEM.md, 2026年07月04日.

Every LLM-consuming service points its OpenAI SDK base_url at Selva's OpenAI-compatible /v1 surface. Service code must not talk directly to OpenAI, Anthropic, or any other provider.

The endpoint moved on 2026年07月07日. RFC 0034 P2 extracted the /v1 proxy out of nexus-api into its own deployable, selva-inference-gateway, at https://inference.selva.town. The nexus-api /v1 mount was removed (selva-office#217). Live-verified that day: inference.selva.town/health → 200; unauthenticated /v1/chat/completions → 401; api.selva.town/v1 → 404. The gateway /health was re-probed 200 on 2026年08月24日. Any doc that still names nexus-api or selva.town/v1 as the inference endpoint is describing a surface that no longer exists.

Provider credentials (Anthropic, OpenAI, DeepInfra, Together, Fireworks, SiliconFlow, Moonshot) are intended to live only on Selva.

Known deviations, dated. This is the contract, not a verified fleet state. The 2026年07月09日 phynd-crm platform audit found its reddit-bot builds its client from OPENAI_BASE_URL with no fallback guard, so an unset value fails open to api.openai.com with a local OPENAI_API_KEY — recorded as an ecosystem violation, with the fix (repoint to the gateway, make the base URL fail-closed) ranked #3 on that audit's remediation list. A 2026年07月19日 activation runbook also writes an openai_api_key into Fortuna's own secret. Deviations are tracked privately.

PhyndCRM lead → Selva drafter (LLM) → email (Resend) → PSP webhook →
 payment.succeeded emitted, signed, in parallel to:
 ├─ Dhanam POST /v1/billing/madfam-events → BillingEvent row
 └─ PhyndCRM POST /api/webhooks/routecraft → conversions row + source-agent credit

Signature: x-madfam-signature: t=<unix-seconds>,v1=<hex-hmac-sha256> over "${ts}.${raw-body}", per-target secret, 5-minute replay window. Both receivers are idempotent by the emitter's event_id.

As built vs ratified target. The emitter above is routecraft (@routecraft/payments::emitPaymentSucceeded). The decision of record (internal-devops/decisions/2026-05-04-payment-emission-soc.md, reaffirmed by the 2026年07月08日 execution plan) is different: Dhanam becomes the sole payment emitter; routecraft becomes a payment consumer and attribution emitter. None of that migration had landed as of 2026年07月08日.

Not flowing as of 2026年07月08日. That execution plan, verified against routecraft at HEAD, records: only the Conekta webhook emits (the Stripe path emits nothing), the attribution sub-object is never populated, there is no payment.refunded, and the emitter target secrets are absent from production manifests — so the fan-out is a silent no-op today. The 2026年07月16日 audit independently scores this edge RED: "Fan-out targets wrong route + secret + header → first sale leaves zero trace."

A revenue-loop-probe CronJob is specified to exercise this chain hourly and page on failure. As of the 2026年07月16日 audit the probe was off and alert delivery had been dead for ≥31 days; re-enabling it is a tracked operator blocker.

Dated clarification (2026年08月24日). The first completed live charge (2026年08月02日, §VI) did not flow through this routecraft fan-out: it ran Dhanam's own PSP webhook path — Stripe MX → Dhanam webhook processor → billing_events + entitlement → Karafiel CFDI — i.e. the direction the ratified target points. The fan-out's as-built status is as recorded above; no newer verification of it exists in this document's sources.

Every service ships an explicit origin allowlist. Wildcards are banned. The rule traces to the 2026年04月23日 audit (findings H2/H5/H6). The newest service implements it literally: meridian's API requires CORS_ALLOWED_ORIGINS and refuses to start without it rather than defaulting to something permissive, and deliberately omits its own marketing host from the list.

Enclii (web, API, or CLI) is the mandatory control plane for routine production operations: provisioning, deployment, observability, domains, secrets, provider operations, scaling, rollback, remediation.

Raw kubectl, helm, SSH, provider CLIs/APIs, docker exec and direct container access are permitted only for (a) platform bootstrap or (b) documented break-glass when Enclii is unavailable or lacks an implemented adapter. Any such use must record the actor, the reason, the target service and environment, the commands executed, the result, and a follow-up Enclii adapter-gap note or incident link. Recording the adapter gap is mandatory, not optional.

Enforcement of this doctrine is documentary, not technical — a banner convention plus a docs-linting script in internal-devops. There is no admission-time or CLI-time block on raw kubectl.

Deploy flow (internal-devops/ecosystem/deployment-conventions.md): push to main → CI builds the image → GHCR → image signed with cosign keyless → kustomize edit set image pins the digest → CI commits that back to the app repo → ArgoCD pulls and syncs. Nothing pushes to the cluster. Since 2026年08月21日 a container-image CVE scan gate (Trivy) blocks CI in the core platform repos (verified present in enclii and janua workflows at HEAD, 2026年08月24日; recorded fleet-wide in the private remediation log). ArgoCD self-heal is on, so a live kubectl patch will be reverted; permanent config changes must be committed.

Onboarding is zero-touch by contract (RFC 0014): adding a service must not require editing the enclii, janua or dhanam repos. All deploy config lives in the app repo. If an onboarding cannot be done without a platform-repo edit, that is a platform gap to file, not to route around.

Brand DAM ↔ generation ↔ consumption — the three-way split. ceq is both the system-of-record for a client's source brand book (the curated, tenant-scoped Client/BrandKit/BrandAsset model on R2, tenant-from-token à la acervo — designated here 2026年09月02日) and the generation pillar that renders derivative work from it (/v1/render/*). Consumers do NOT read ceq at runtime: they pull the resolved /v1/brand-kits/{id}/tokens document and vendor it locally (per the deprecation of a central @madfam/ui in favour of per-app tokens — see @madfam/core note below). MAP (crea-map) aligns its local globals.css tokens + clinic-identity.ts + public/ logos against that export; it never imports ceq. The DAM stores the truth once; each product keeps its own clean-exit copy.

• Cross-service event bus. Services exchange lifecycle events over a shared bus (domain streams, per-service consumer groups, dead-letter queues). The event-schema registry is governed privately; the event shapes used by public code live in @madfam/types.
• Payment-method vocabulary. Dhanam and Karafiel share a versioned payment-method / settlement-rail vocabulary and its SAT c_FormaPago mapping. Canonical copy governed in internal-devops; each consuming repo vendors a byte-identical copy enforced by contract tests.

"Give away the roads, toll the destinations."

The strategy is: infrastructure and standards open so the ecosystem has something real to adopt; the market-gap intelligence and revenue engines closed.

The table below reports what the LICENSE file in each working tree actually says, re-checked 2026年08月24日. Where it and docs/LICENSING_STRATEGY.md disagree, the LICENSE file wins, per that document's own rule:

The Yantra4D Commons class is CERN-OHL-W-2.0. The 2026年07月04日 org-wide audit found roughly ten active repos with no LICENSE file at all, custom-msh's LICENSE file is a saved HTML 404 page, and ultimate-box / multiboard / keyv2 / stemfie / julia-vase carry license contradictions. Licensing compliance across the org is an open gap, not a finished matrix.

This section is dated and deliberately unflattering. The last whole-funnel assessment is still the 2026年07月16日 internal launch-readiness audit (verdict NO-GO, six of eight funnel hops RED). But its central fact has since been overtaken by a dated event:

On 2026年08月02日 the funnel completed end to end for the first time. A real, live-mode card charge on Dhanam (a product subscription) produced a real SAT-stamped CFDI through Karafiel, billing_events rows from a clean zero baseline, and the entitlement behind it — verified by the internal post-charge verifier and recorded permanently in internal-devops/runbooks/ (2026年08月03日 evidence record). billing_events = 0 is no longer true. One completed charge is a threshold, not traction — but it is the threshold this section spent months reporting as unmet.

Status, with the honest date on each:

• Commercial loop. First live charge + CFDI + entitlement completed 2026年08月02日 (above). A fractional-CTO services line (Nauta) is operating with a live cockpit and an auth-gated client workspace (probed 2026年08月24日). The 2026年07月16日 audit's sixteen blockers are tracked privately; this document does not claim how many remain closed.
• Routes. Every platform route in §II was re-probed on 2026年08月24日 for the private domain map refresh. Live and answering: the full Enclii/Janua/Dhanam/Tezca/Yantra4D/ ForgeSight/Karafiel/Avala/Rondelio/Selva/BlueprintTube/Cotiza/Coforma/Pravara/Fortuna-web families, plus Fashion Cabinet, Kalya, Acervo, Nauta, Voxa, eido, and 3 of 4 meridian surfaces. Found down that day: api.fortuna.tube (502), meridian-api (502), and the madfam-site CMS host (404) — recorded as gaps in the private map, not papered over.
• Foundation depth. The 2026年08月14日 internal sovereign-pivot audit direction: the house topology (bare-metal k3s, single Cloudflare Tunnel) extends toward single-tenant, client-owned clusters for client-sovereign deployments; the provisioning template is the tracked gap. Fleet-wide CVE gating (Trivy) landed 2026年08月21日 (§IV.6).
• Intelligence depth. Route-live is not content-healthy: the 2026年07月16日 BloomScroll remediation (OWID connector broken; 5 of 6 content types real) still stands as the newest depth check recorded here, and Fortuna's API being 502 on 2026年08月24日 says its edge needs attention now.
• Engines. geom-core's mesh-analysis core is real, but neither the npm nor the PyPI artefact is published yet and its CI cannot build them, so nothing consumes it today. Sim4D is archived (by 2026年08月07日) — parametric design consolidated into Yantra4D, whose commons now spans ~36 active public hyperobject repos plus the private Fashion Cabinet soft-goods commons and the hyperobjects-spec conformance keystone.
• Frontier. Galvana still has no repo; electrochem-sim recorded stale since 2025-11.
• Horizontal integration. Selva cutover complete (2026年07月01日); inference gateway live (/health 200 re-probed 2026年08月24日). The routecraft payment-attribution fan-out remains as recorded in §IV.4 — the 2026年08月02日 charge ran Dhanam's own PSP path instead, which is the ratified direction.

Strategic detail — catalog audits, competitor benchmarking, launch-wedge selection, rotation schedules, the blocker ledger — lives in the private internal-devops repo.

Verified against the enclii CLI source and this repo's compose files on 2026年07月25日.

enclii local up # starts shared infra, then Janua + Enclii
enclii local infra # shared infra only: PostgreSQL, Redis, MinIO, MailHog
enclii local status
enclii local logs [service]
enclii local down

Two corrections to earlier editions of this doc, both checked in enclii/packages/cli/internal/cmd/local.go:

• enclii local up with no arguments starts Janua and Enclii only, not "all services". Pass service names to start more.
• enclii local infra starts PostgreSQL, Redis, MinIO and MailHog. It does not include Verdaccio — a claim that appeared in an earlier version of AGENTS.md.

The CLI drives solarpunk-foundry/ops/local/docker-compose.shared.yml on the Docker network madfam-shared-network. That is the canonical local stack.

cd ~/labspace
./madfam start # core: janua, forgesight, digifab-quoting, madfam-site
./madfam full # 10 declared services (see caveat)
./madfam status
./madfam logs janua
./madfam stop # --clean to wipe volumes

./madfam is a symlink to solarpunk-foundry/ops/bin/madfam.sh. full declares 10 services, not 18 (verified against the script's four service arrays on 2026年07月25日): janua, forgesight, digifab-quoting, madfam-site, madfam, primavera3d, dhanam, fortuna, sim4d, electrochem-sim. Two of those — madfam and electrochem-sim — have no checkout under ~/labspace, so full cannot start them.

Databases created by ops/local/init-databases.sql: janua_dev, enclii_dev, forgesight_dev, fortuna_dev, cotiza_dev, avala_dev, dhanam_dev, sim4d_dev, forj_dev. A second, older file — ops/db/init-shared-dbs.sql — creates *_db-suffixed names from a superseded scheme; several public docs still quote those. The _dev set is the one the CLI provisions.

The root docker-compose.yml is not currently usable and is not the canonical path: its janua service targets a development stage that does not exist in janua/apps/api/Dockerfile (which defines only builder and runner, both Python), and its enclii-api service points at enclii/Dockerfile, which does not exist — Enclii's Dockerfiles are per app under enclii/apps/*/Dockerfile. It also declares the network madfam-network, while the canonical stack uses madfam-shared-network. Use enclii local up. (Checked 2026年07月25日.)

The ecosystem-wide 4xxx/5xxx port scheme is aspirational. Do not read a port out of any document and assume it is what a service listens on — read docs/PORT_ALLOCATION.md, which is honest about how few services follow the scheme, and then check the owning repo's enclii.yaml.

In production, hostname routing makes container ports invisible to callers — but they are not irrelevant: the Enclii control plane generates NetworkPolicies from enclii.yaml's network.services[].port and applies them via the K8s API. If that declared number does not intersect the pod's actual containerPort, the CNI drops the traffic silently, and it presents as a rendering or timeout bug rather than a network one.

Fifteen packages under packages/, intended for the private npm.madfam.io Verdaccio registry, plus one tombstone. ls packages | wc -l returns 16: the fifteen below and retired ui/. Directory listing and versions re-verified 2026年09月05日.

Retired (2026年09月05日, Wave 4.5): @madfam/ui is a tombstone — packages/ui/ keeps a README and a private: true manifest recording the retirement, and no source, build or publish path. It is not counted above. The UI system moved to the per-app "incubator" model (@dhanam/ui); scripts/publish-ui.sh and scripts/link-ecosystem.sh moved to scripts/archive/. Full record: packages/ui/README.md.

Registry reality, checked 2026年08月24日: @madfam/core@0.1.0 is published on the public npmjs.org registry (the only one of the set that is). The other packages then in the set returned 404 on public npm — several declare publishConfig.access: public but were apparently never published anywhere queryable. Whether any are present on the private npm.madfam.io Verdaccio is still unverified from this repo (needs a registry query or a dated operator attestation). publishConfig targets are inconsistent across the set — some declare the public registry, some the private one; docs/MONETIZATION_PATH_READINESS.md records this drift. The versions above are what package.json declares in the working tree.

@madfam/webhook-attribution exists precisely so the §IV.4 signing contract is not reimplemented per repo. As of the 2026年07月08日 verification, no repo had adopted it; Dhanam and routecraft each carry their own byte-identical implementation.

The three config packages (@madfam/tsconfig, @madfam/eslint-config, @madfam/prettier-config) are publishable-shaped and not published as of 2026年09月05日: versioned, private: false, files and publishConfig set, each with a README. The foundry adopts them itself first — every package extends the shared tsconfig and ESLint config, the root points prettier at the shared Prettier config, and scripts/check-shared-configs.mjs fails Package Quality if one stops. The CI contract a consuming repo must run is templates/ci/README.md § "Consumer CI contract".

Publishing: pnpm publish:all → scripts/publish-all-sdks.sh publishes the per-platform client SDKs from other repos, not this repo's @madfam/* set. The CI path is .github/workflows/publish-package.yml (workflow_dispatch, with a dry_run input). scripts/publish-ui.sh was retired with @madfam/ui on 2026年09月05日.

This repo is public. It deliberately does not hold:

• Node hostnames, public IPs, hardware models or capacity figures, provider account numbers, costs, SSH targets, or the Cloudflare tunnel identifier → private internal-devops
• Actual secrets, API keys or Vault tokens, or Vault paths with retrieval detail → ExternalSecrets + Vault; literal secrets live nowhere
• Strategic, competitive or pricing intelligence → internal-devops/ecosystem/
• Ecosystem audits carrying revenue, customer or cost data → internal-devops/audits/
• Per-session remediation plans, cutover runbooks, rotation schedules, incident evidence trails → internal-devops/runbooks/ and internal-devops/incidents/
• Raw break-glass kubectl / SSH procedures → internal-devops

If you have operator access, start at internal-devops/README.md. Otherwise, contact admin@madfam.io. (Do not use any @innovacionesmadfam.dev address — that domain was never owned; owner confirmation 2026年07月09日.)

Exposure status, updated 2026年09月05日. The infrastructure/ scrub that was "in flight" in the 2026年08月24日 edition landed on 2026年07月25日: the tree now carries historical banners and a removal ledger documenting what was deleted and why (including the tunnel identifier and admin roster), and a 2026年08月24日 sweep of the working tree found no live credentials, internal IPs, or client identifiers. The scanner caveat that stood in the previous edition is closed: since 2026年09月04日 scripts/public-hygiene-check.sh reads every tracked text file, carries a public-IPv4 class, and checks node identity — hostnames, node IPs and hardware SKUs — against a private pattern file supplied via MADFAM_HYGIENE_PATTERNS (§IX below). The hosting provider name was ruled public on 2026年09月05日 and is not one of those private patterns; node hostnames, IP literals and server SKUs remain forbidden here. One caveat still stands: removing material from HEAD does not undo git history — identifier rotation is an operator action and remains owed, tracked in internal-devops.

1. One PR per concern. Branch off main, target main. Never commit to main directly.
2. Conventional commits (feat:, fix:, chore:, docs:, ...).
3. No custom auth — use Janua (§IV.1).
4. No literal secrets — ever.
5. No data duplication — query the §IV.7 owner.
6. No undated status claims. If you assert that something works, name the source and the date it was verified, and distinguish verified / documented but unverified / aspirational. docs/PORT_ALLOCATION.md is the model.
7. Update docs/PORT_ALLOCATION.md if your service claims a port.
8. No marketing language. No superlatives, no invented metrics, no adoption numbers.

CI on this repo runs documentation lint, package quality, a production-readiness ratchet, public-hygiene scanning and repository hygiene (.github/workflows/). Since 2026年09月04日 the public-hygiene scanner reads every tracked text file (not just .md / .mdx / .txt), flags public IPv4 literals, and checks node identity against a private pattern file passed through MADFAM_HYGIENE_PATTERNS. That file lives outside this repo, so when it is not readable the class is skipped and the run ends with classes_skipped=1 — read that line, and treat a green run with a skipped class as unchecked, not clean. Passing CI is still not proof a change is boundary-clean; human review against §IX is the control that matters. Coverage detail: docs/PUBLIC_REPO_BOUNDARY.md.

This repo is MIT (LICENSE, package.json). Individual packages declare their own license in packages/*/package.json. Non-code docs (this README, docs/*.md) are CC-BY-SA 4.0 unless otherwise noted.

Predecessor brand: Aureo Labs (aureolabs.dev), retired 2026年04月17日; the aureo-labs repo is public and archived (2026年04月08日). aureo.studio is held for brand protection and redirects here.

"The best way to predict the future is to manufacture it."

MADFAM — High tech, deep roots. From bits to atoms.

This repository is public (Lane B). Live secrets, node identity, IPs, hardware and capacity figures, cost ledgers, incident internals, and production break-glass material belong in the private internal-devops repository or in Vault/ExternalSecrets — never here. Canonical policy: internal-devops/docs/repo-boundary-contract.md (last updated 2026年06月14日). Public-repo checklist: docs/PUBLIC_REPO_BOUNDARY.md.