6.sContent CMS — versioned grounding docs (CLAUDE.md / skills.md)

1. Why grounding docs

An AI call is only as disciplined as the context it carries. Rather than bake rules into each cartridge's code (where they drift and can't be changed without a deploy), the platform keeps operator-authored CLAUDE.md and skills.md in a versioned store. A cartridge reads the active version at call time and fences it into the system prompt; a scheduled evaluator pulls it over the Console MCP with a hash-check so it only re-downloads what changed. Edit the doctrine once, and every consumer follows it on its next run.

2. The data model

A doc is a series of versions (v1, v2, …) with one active pointer, keyed by (cartridge, scope, name):

• cartridge — the owning cartridge id (e.g. foundation-audit).
• scope — a free tag: an adapter id (zenhub, github), a persona (product-owner, testing), or _ for cartridge-wide.
• name — the doc, typically claude or skills.

Upload appends a new version and activates it by default; the store keeps every version + who saved it + when (shared/modules/content/store.js: getActive, getSeries, upload, activate, remove). The table is <project>-console-content (pk = cartridge, sk = <scope>#<name>#v<n> + a meta row holding the active/latest pointers).

3. How cartridges consume it

Consumption is server-side, not an SDK helper: a cartridge's Lambda stages the content module, reads the active docs for its (cartridge, scope), fences them, and prepends the block to the Bedrock system prompt. squad-assess does this for every assessment gate (cartridge-wide _ first, then the gate's scope). The Console MCP exposes the same store as read tools — grounding_manifest (list with sha256) and grounding_get (fetch one) — so an external evaluator grounds itself the same way.

4. Where it is edited

Routes follow /api/content/{cart}/{scope}/{name} (list / get / active / upload / activate / delete); the per-cartridge editors are thin wrappers that force their own cartridge id. Uploads run through the Console's safety scanner.

5. The safety fence

Operator guidance is content, not instructions to the platform. shared/modules/content/safety.js fences each doc when it is injected into a system prompt — wrapping it so a grounding doc can steer the task without smuggling directives that override the platform's own controls. Uploads are also scanned; a blocking finding refuses the upload, a warning asks for acknowledgement.