A second field note from the commons. The first one described scaffolding being poured in public. This one describes what gets built on top of it once the concrete sets.
The commons, still
SecOps-NG is a Digital Commons for sovereign security operations in Europe — shared playbooks, durable workflows, and evidence primitives for organisations meeting the European regulatory baseline. Not a vendor. Not a consultancy. The work is community-driven, auditable in the open, and biased toward European-resident hosting and European-origin libraries. That framing is the load-bearing wall; everything below is what has been built against it since the last note.
Workflow architecture: one layout, one place to look
The framework now has a canonical workflow layout. Each workflow lives
in two predictable locations — a runnable entrypoint under
framework/workflows/<name>.py and the implementation under
framework/src/<pkg>/workflows/<name>.py. The restructure looks
unglamorous on a diff, and that is the point. A commons is read more
often than it is written. If a new contributor cannot find where a
workflow lives in under a minute, the project has failed them before
they have opened a file. The layout is now boring enough to be obvious.
Posture Audit, end to end in skeleton
The first workflow lane is complete in skeleton form. All six slices landed and passed Custodian review:
- the Cloud Footprint Manifest schema, giving operators a shared vocabulary for what they are auditing,
- a knowledge-base lookup adapter defined as a protocol so the file-backed implementation today can become a richer provider tomorrow without rewriting the workflow,
- a durable evidence-collector pattern for long-running audits that need to gather artefacts safely across retries and restarts,
- and the PostureAuditWorkflow itself, wired together on Temporal.
Skeleton means the shape is right, the seams are visible, and the interfaces are stable enough for the next contributor to start filling slices without renegotiating the architecture. That is the bar a commons should hold itself to before declaring a lane open.
A second workstream opens: vulnscan
A new repository, secops-ng-vulnscan, has been opened as a sibling
workstream. Posture Audit answers what does our footprint look like;
vulnscan begins to answer what is exposed in it. The two lanes will
share the workflow conventions, the evidence model, and the sovereign
deployment story. Treat the kickoff as a placeholder for now — the
repository exists, the conventions are inherited, and the first slices
will land in the open.
Reference path for sovereign deployment
A deployment quickstart is published in the framework repository describing a reference path on Nebul with Mistral and Temporal. It is one path, not the path. The commons is opinionated about EU sovereignty and agnostic about which EU operator a community member chooses. If you want to run the workflows on a different EU-resident stack, the quickstart is meant to be cloned and adapted, not prescribed.
A roadmap that renders itself
The ROADMAP page is now auto-generated from the public kanban. Whatever the commons is working on next is visible without a separate document to drift out of date. If a card moves on the board, the roadmap moves with it. This is the same instinct as the workflow layout: the project should be legible to a stranger without anyone having to be asked.
Hygiene, again
Several forward-public hygiene passes landed alongside the features — revisions to the Code of Conduct, governance, and the contributor onramp. None of this is exciting work. All of it is what makes the front door of a commons safe to walk through.
Reading along
The framework, the website, and these field notes all live under github.com/secops-ng. The repositories are moving toward public visibility. Watching the organisation on GitHub remains the most direct path to following the work as the lanes mature.
More soon, from the lanes.