# SCBE Package Registry and Governance Bridge

AetherDesk exposes a local read-only package manifest at:

```text
GET /api/scbe/packages
```

The route is status/reference only. It does not publish packages, reveal tokens, or execute shell commands.

## Current package lanes

| Registry | Package | Version | Install |
| --- | --- | --- | --- |
| npm | scbe-aethermoore | 4.2.1 | `npm install scbe-aethermoore` |
| PyPI | scbe-aethermoore | 4.2.1 | `pip install scbe-aethermoore` |
| npm | scbe-agent-bus | 0.4.1 | `npm install scbe-agent-bus` |
| PyPI | scbe-agent-bus | 0.3.0 | `pip install scbe-agent-bus` |
| npm | scbe-aethermoore-cli | 4.4.0 | `npm install -g scbe-aethermoore-cli` |
| PyPI | scbe-govern | 0.1.0 | `pip install scbe-govern` |
| PyPI | scbe-bookforge | 0.1.0 | `pip install scbe-bookforge` |
| PyPI | scbe-polly-pad | 0.1.0 | `pip install scbe-polly-pad` |
| npm | scbe-polly-pad-cli | 0.1.0 | `npm install -g scbe-polly-pad-cli` |

## Governance bridge contract

Start the SCBE bridge from the SCBE-AETHERMOORE repo:

```powershell
uvicorn workflows.n8n.scbe_n8n_bridge:app --port 8001
```

Call it from any language:

```powershell
curl -s -X POST http://localhost:8001/v1/govern/check `
  -H "Content-Type: application/json" `
  -H "X-API-Key: <local key>" `
  -d '{"command":"chmod 644 /app/file.txt"}'
```

Expected shape:

```json
{
  "tier": "QUARANTINE",
  "score": 0.469,
  "d_H": 0.7,
  "pd": 0.0,
  "role": "move",
  "command": "chmod 644 /app/file.txt",
  "agent_id": null
}
```

Tier reference:

| Tier | Score | Meaning |
| --- | --- | --- |
| ALLOW | >= 0.60 | Normal operation; execute. |
| QUARANTINE | 0.30-0.60 | Elevated risk; execute only with audit/provenance. |
| DENY | < 0.30 | Block before subprocess or tool execution. |

## AetherDesk boundary

The desktop window is intentionally a reference cockpit. It shows package lanes, install commands, and the bridge contract. Any future publish, delete, push, or host-write action should be added as a separate gated route with receipts and tests.
