Governed Asset lifecycle

Understand how knowledge becomes a governed Asset from draft through publication and delivery.

Registry Assets make organizational capability reviewable and reproducible. Every consumer uses an exact immutable release; mutable drafts never cross the delivery boundary.

Lifecycle model

Draft

Mutable authoring state owned by the Asset.

Revision

An immutable submitted payload and change note.

Review

A separate actor records an explicit decision.

Release

Approved bytes and profile data are pinned immutably.

Use

Web, Assistant, MCP, or CLI resolves the exact authorized release.

A Registry Asset moves from an accountable draft to an immutable, authorized release.

The registry owns stable Asset identity, owner and backup-owner assignments, drafts, immutable revisions, review decisions, releases, availability history, and actor-scoped usage evidence. Before showing governance controls, the API computes the current actor's live submit, review, publish, and withdraw decisions. The mutation repeats authorization; the UI result is only an affordance.

An author cannot approve their own revision. Forking a release creates a new draft but copies neither approvals nor reviews. Withdrawing a release blocks new consumption without rewriting its historical bytes.

Supported profiles

Profile	Release contract
Prompt Template	Typed variables, deterministic rendering, data policy, output contract, knowledge requirements, and bounded evaluations
Work Instruction	Purpose, prerequisites, ordered steps, expected results, checks, escalation, and prohibited actions
Capability Pack	An ordered journey that pins exact required or optional Asset releases and Knowledge versions
Skill	A bounded Agent Skills ZIP with validated `SKILL.md`, digest, media type, and exact file manifest

Profile validation is code-owned and versioned. The shared registry does not use type-specific database columns.

Delivery invariants

recommendations contain an exact release the actor can currently use;
withdrawn releases cannot start new use;
Pack components are authorized independently;
replacement releases never mutate an existing Pack pin;
Skill ZIPs are inspected and hashed but never extracted or executed;
object-storage keys, drafts, reviews, roles, and governance history do not cross the read-only MCP delivery boundary;
external provider calls and state-changing Assistant actions require explicit confirmation.

Ownership health

Every Asset view derives whether an active owner and backup owner are present. Missing coverage produces explicit orphaned or continuity-risk indicators. It does not change release bytes and cannot grant authorization.