chore: bootstrap capability inventory (docs/project-state.md)

[toddysm]

Summary

Bootstraps the project capability inventory at docs/project-state.md, generated by My Feature Engineer (work-status skill) from existing GitHub issues/PRs and a code scan on 2026-08-25.

This is the durable, version-controlled record of what the project has and is building, complementing the transient work-in-flight tracking.

What's inside

• Implemented (17 capability groups): Acquire (mirroring, hardened images, acquisition-provenance, mirror-history), Catalog (scan-and-promote gate, override approval, vuln-attestation base, referrer-aware cleanup), Build (multi-arch, SBOM/provenance referrers, semver tagging, security-policy annotations), Run (CSSC Dashboard demo app), cross-cutting CI-failure automation, and Observability supply-chain graph Phases 1–6 + referrers/deletions + multi-arch index model.
• In progress (7): supply-chain graph epic Supply-chain graph: implementation tracking (epic) #177, per-platform referrer rollup Roll up per-platform attestations to the image in graph queries/views #217 (PR Roll per-platform child referrers up to the index in graph queries #221), provenance timeline Provenance timeline view for the supply-chain graph (digest-level, dated, per-family) #210, multi-arch graph presentation Design: represent and present multi-arch (index) + per-architecture manifests in the graph #218, ImageIndexObserved staging Stage ImageIndexObserved events from the build/app-image workflows #220, vuln-attestation wiring scan-image: emit a cosign-vuln in-toto vulnerability attestation #147–Docs: document the vulnerability-attestation scan-report referrer #151, mirror-history validation.
• Planned (2): Kùzu graph store Supply-chain graph: index image flow with Kùzu (embedded graph store) #145, file-backed discovery reqs Supply-chain graph: define file-backed artifact discovery and lineage requirements #168.
• Deferred (1): supply-chain graph Phase 7 Supply-chain graph — Phase 7 (deferred): SBOM/scan ingestion + CVE queries #176.
• Known gaps & debt, including that the only GitHub Project ("CNSR Roadmap Project") tracks a separate ACR roadmap — this repo runs issues-only.

Review notes

• Content is inferred from issue/PR history and code. Rows/dates marked > NOTE: inferred need a human read before they are treated as canonical.
• Landed years are approximate (merge dates not individually resolved).
• Do not auto-merge — this is a human review gate, same as a PRD gate.

[Copilot]

🟡 Changes recommended

The new doc contains a few concrete accuracy/actionability issues (non-existent reference, inconsistent landed date vs issue history, and misleading Kùzu planning wording) that should be corrected before merging.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Bootstraps a new, version-controlled “capability inventory” document (docs/project-state.md) that summarizes what the CSSC framework has implemented, what is in progress, and what is planned/deferred, based on existing issues/PRs and a code scan.

Changes:

• Adds docs/project-state.md with capability tables (Implemented / In progress / Planned / Deferred).
• Captures known gaps & debt and clarifies how status is classified (issues-only, not a project board).

File summaries

File	Description
docs/project-state.md	Introduces the initial capability inventory and status breakdown for the project.

Review details

Suppressed comments (1)

docs/project-state.md:80

• This mentions “the requirements folder”, but there is no requirements directory in the repo (only language requirements.txt files), so the guidance isn’t actionable as written.

| No PRD/EDD documents on record for pre-agent capabilities | Most Implemented rows predate agent-managed planning; `PRD doc` column is `—`. New features should author a PRD+EDD under the requirements folder. |

• Files reviewed: 1/1 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 312397375e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🟡 Changes recommended

The new inventory doc contains a few durability/consistency problems (Implemented rows lacking doc links despite existing docs, and time-sensitive PR status text) that should be fixed before merge.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (1)

docs/project-state.md:44

• These Implemented rows have Docs set to —, which conflicts with the file’s stated rule that Implemented implies user docs have landed. There are already relevant docs in-repo (graph model doc for multi-arch index↔child, and the promote-from-quarantine workflow doc for referrer-preserving promotion/cleanup), so linking them here would make the inventory easier to validate and keep consistent.

| Observability: model multi-arch index ↔ per-architecture child manifest relationship | multiarch-index-platform | [#216](https://github.com/toddysm/cssc-framework/issues/216) | — | — | 2026-08 |
| Catalog: promotion + quarantine cleanup includes all referrers (OCI 1.0 + 1.1) | promote-referrers | [#198](https://github.com/toddysm/cssc-framework/issues/198) | — | — | 2026-08 |

• Files reviewed: 1/1 changed files
• Comments generated: 2
• Review effort level: Lite